How to scan precompiled.net code in AppScan Source

Size: px

Start display at page:

Download "How to scan precompiled.net code in AppScan Source"

Jonathan Allen
6 years ago
Views:

Panelists Sherard Howe, Presenter - AppScan Source SWAT Scott Hurd AppScan Support Engineer Karl Weinert AppScan Source Support Engineer Robert Fiszer AppScan Source Support Engineer Joe Kiggen,

1 Panelists Sherard Howe, Presenter - AppScan Source SWAT Scott Hurd AppScan Support Engineer Karl Weinert AppScan Source Support Engineer Robert Fiszer AppScan Source Support Engineer Joe Kiggen, Moderator AppScan Support Manager IBM Security AppScan Source Open Mic Mar 30, 2016 How to scan precompiled.net code in AppScan Source Reminder: You must dial-in to the phone conference to listen to the panelists. The web cast does not include audio. USA: Toll: Participant passcode: Slides and international phone numbers: in the Open Mic Webcast NOTICE: By participating in this call, you give your irrevocable consent to IBM to record any statements that you may make during the call, as well as to IBM's use of such recording in any and all media, including for video postings on YouTube. If you object, please do not connect to this call.

2 Goal of session To better understand how to automate the setup and scan of.net pre-compiled code to prevent common compilation errors and DTE errors.

3 Table of contents / Agenda How AppScan Source scans.net source code Historical issues scanning.net source code Creating.NET Assembly projects in the past The Solution

4 How AppScan Source scans.net code The Process: Debug build is performed DLLs and PDB files are scanned

5 Historical Issues scanning.net code Problems: Longer scan times DTE errors Interactive dialogs interfered with automation

6 Creating.NET Assembly projects in the past Advantages: Removes the build process from the scan Avoids DTE errors and hung scans Disadvantages: Manually & Tedious Required intimate knowledge of the solution Could not be automated

7 The Solution DotNetAssemblyAppGen Leverages MSBuild Creates.NET Assembly project Filters can be applied Leverages AppScan Source for Automation

8 The Solution (cont d) Example Command for scenario #1: msbuild WebGoat.NET.sln /t:build /p:configuration=debug Java jar DotNetAssemblyAppGen jar l WebGoat.NET.sln

9 The Solution (cont d) Example Commands for scenario #2: msbuild WebGoat.NET.sln /t:build /p:configuration=debug Java jar DotNetAssemblyAppGen jar l WebGoat.NET.sln f Common

10 The Solution (cont d) Example Commands for scenario #3: msbuild WebGoat.NET.sln /t:build /p:configuration=debug Java jar DotNetAssemblyAppGen jar l WebGoat.NET.sln f Common s C:\Program Files (x86)\ibm\appscansource

11 Questions for the panel? Now is your opportunity to ask questions of our panelists. To ask a question now: Press *1 to ask a question over the phone or Type your question into the IBM Connections Cloud Meeting chat To ask a question after this presentation: You are encouraged to participate in our Forum topics AppScan Source forum.

More articles you can review: Technote x: <link> IBM developerworks articles: <link> IBM

12 Where do you get more information? Questions on this or other topics can be directed to the product forum: AppScan Source forum. More articles you can review: Technote x: <link> IBM developerworks articles: <link> IBM Knowledge Center: <link to product welcome page> Useful links: How to Contact IBM Software Support for IBM Security IBM Support Portal Sign up for My Notifications Follow us:

Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your

13 Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. THANK YOU Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or capabilities referenced in these materials may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.

IMS Request for Enhancements (RFE) for Customer Requirements

IMS Request for Enhancements (RFE) for Customer Requirements Betty Patterson IBM February 5, 2013 #13188 Acknowledgements and Disclaimers Availability. References in this presentation to IBM products,