如何检查我的应用程序是否可以免受常见的攻击类型
我有一些应用程序暴露了公共终点。
我想知道这些应用程序是否可以免受某些常见的攻击类型的保护，例如（CSRF，XSS，SQL注入）。
鉴于这些应用程序的代码大小，几乎不可能检查所有这些可能的安全漏洞。
我想知道是否有任何开源库可以扫描代码或检查端点是否可以免受这些攻击的安全性，或者我们可以在CDN层中配置的任何企业级别的解决方案或可能在构建步骤上以检查可能检查对于漏洞并警告开发人员。
我们的大多数应用都在Java和Golang。
已经阅读了一些诸如Esapi，Owasp CSRFProtector项目，Owasp CSRFGuard之类的信息，但它们无法满足我的要求。
另外，我正在寻找的解决方案应该在集成部分上具有最低限度的开发功能，例如添加一些lib或配置某些内容。
任何线索都将不胜感激。
I have a few applications some of which expose public endpoints.
I wanted to know if these applications are safe from some common types of attacks like (CSRF, XSS, SQL Injection).
Given the size of code these applications hold, it's almost impossible to go and check for all these possible security vulnerabilities.
I wanted to know if there is any open source library which can scan the code or check if an endpoint is safe from these attacks, or any enterprise level solution which we can configure in the CDN layer or may be on the build steps to possibly check for the vulnerabilities and warn the developer.
Most of our applications are in Java and golang.
Have read about a few like ESAPI, OWASP CSRFProtector Project, OWASP CSRFGuard but they don't fulfil my requirements.
Also the kind of solution I am looking should have minimum dev work on the integration part like just adding some lib or configuring something.
Any leads will be appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
安全很难：)没有银色子弹，任何声称存在的东西充其量是“误导”的。源代码扫描（SAST）很重要，但它可以标记许多误报，并且不会告诉您真正脆弱的事情。动态扫描（DAST）工具攻击您的端点 - 这为您提供了“攻击者”视图。理想情况下，您应该同时使用两者。最受欢迎的DAST扫描仪是Owasp Zap（ https://www.zaproxy.org ）完全免费（免责声明，我是ZAP项目负责人;）。它不需要对您的应用程序进行任何更改，但是需要进行一些设置和配置才能从中获得最佳状态。它在自动化中大量使用，因此您可以在开发和分期环境中使用它 - 通常比生产中的测试更好:)
Security is hard :) There is no silver bullet, and anything that claims to be is "misleading" at best. Source code scanning (SAST) is important but it can flag lots of false positives and doesnt tell you whats really vulnerable. Dynamic scanning (DAST) tools attack your endpoints - this gives you an "attackers" view. Ideally you should use both. The most popular DAST scanner is OWASP ZAP (https://www.zaproxy.org) - its open source and completely free (disclaimer, I'm the ZAP project lead;). It will not require any changes to your app but it will take some setting up and configuring to get the best out of it. Its heavily used in automation so you can use it in your dev and staging environments - theis is usually better than testing in production :)