The testing plan gave an overview of the testing approach, risk assessment, and suggested testing tools. In this chapter, we will focus on whitebox testing tips.
Whitebox code review can be most effective to identify certain specific security issues, such as XXE, deserialization, and SQL injection. However, a whitebox review can be time-consuming if there are no proper tools or strategies. To have an effective whitebox test, we need to focus on specific coding patterns and high-risk modules. This chapter will give tips, tools, and key coding patterns to identify high-risk security issues.
We will cover the following topics in this chapter:
- Whitebox review preparation
- A bird's-eye view of the whole project
- High-risk modules
- Whitebox review checklist
- Top common issues
- Secure coding patterns and keywords
- Case study—Java Struts security review