Using the Web Protection Library (WPL) - CTP Version
Using the Code Analysis Tool (CAT.NET 2.0) to Identify Security Vulnerabilities
Description
Anil Revuru (RV) from Microsoft Information Security, gives a demonstration of the new version of CAT.NET (Code Analysis Tool for .NET) version 2.0. It is a static analysis tool that uses the Phoenix Compiler and its data flow graph.
Anil walks us through the dataflow rules and how it uses the source sink analysis to determine if there is a vulnerability or not. He also explains how the configuration analysis works and walks through the rules where insecure conditions exist. The demo
of the tool shows how the vulnerabilities are detected and how to interpret the results.
To learn more about this application, stay up to date on the latest news by following the Security Tools Team blog.
Watch related webcast
Download: CAT.NET 2.0
Download
Download this episode
- High Quality WMV (50.9 MB)
- MP3 (4.0 MB)
- Low Quality MP4 (24.4 MB)
- WMV (28.3 MB)
More episodes in this series
Technical Preview for CAT.NET 2.0
Related episodes
Technical Preview for CAT.NET 2.0
Architecture Behind CAT.NET
Using the Web Protection Library (WPL) - CTP Version
Using Web Application Configuration Analyzer (WACA) - CTP Version
Web Application Configuration Analyzer (WACA)
Assessment and Protection Suite
Enhanced Web Protection Library
Anti-XSS Library v3.1: Find, Fix, and Verify Errors
Connected Information Security Framework: Core Components
CISF: Build Custom Security Solutions
The Discussion
-
exoteric At last some Phoenix news ("by proxy"). Downloading...
-
troyhunt Can anyone advise where the download for this has gone? The link through to Microsoft Connect is returning 404.
-
psychopetrovich So still noone fixed the download?
Maybe this CAT should run on this blog site to see where links are broken
-
anilkr We were supposed to exit out of the beta with RTM released on MS.COM download center, but we faced some design challenges for external release. You can read more about our efforts on external release at https://blogs.msdn.com/b/securitytools/archive/2010/06/30/cat-net-v2-0-update.aspx.
-
tthtlc frankly this is not worth trying:
https://www.microsoft.com/en-sg/download/details.aspx?id=19968
opensource tools (like clang-tidy from LLVM) can do much better.