Open

You will learn

How to configure an application in ThreadFix to take advantage of ThreadFix's Hybrid Analysis Mapping (HAM) capabilities.

Prerequisites

Audience: IT Professional, or End User
Difficulty: Intermediate
Time needed: Approximately 5 minutes
Tools required: N/A

Introduction

This guide covers configuring an application in ThreadFix to take advantage of ThreadFix's Hybrid Analysis Mapping (HAM) capabilities allowing for better static-dynamic vulnerability merging.

Supported Languages and Frameworks for ThreadFix Hybrid Analysis Mapping (HAM)

Hybrid Analysis Mapping current works for:

• Java/JSP

• Java/Spring

• Java/Struts

• C#/ASP.NET WebForms

• C#/ASP.NET MVC

• Ruby/Ruby on Rails

Support for additional languages and frameworks is planned. Source code can be imported from git repositories, subversion repositories or from local or network folder locations.

Setup

HAM settings can be found by navigating to an application and from the Action drop-down button selecting Edit/Delete.

Open

Setting up an application to take advantage of HAM involves directing ThreadFix toward the source code and (optionally) telling ThreadFix what language and framework the application uses:

The fields are as follows:

• Application Type - What type (language and framework) the application uses. The "Detect" option is preferable as ThreadFix will look at the project folder and attempt to detect the language and framework. If there are detection issues, the specific language and framework can be selected. 

• Source Code URL: This is the git or Subversion URL where the application's source code can be found

• Source Code Branch: The branch of the source code repository to use for analysis (optional)

• Source Code Revision: A specific source code revision to use for analysis (optional)

• Source Code User Name: The user name to use for source code repository access. If none is provided, anonymous access to the source code repository will be used.

• Source Code Password: The password to use for source code repository access

• Source Code Folder: This is the folder (from the perspective of the ThreadFix server) where the application source code can be found if the application is not available via git or Subversion

Providing ThreadFix with access to the application source code will allow the server to perform a lightweight static analysis of the source code and build an internal database of the application's attack surface and the source code elements responsible for each piece of attack surface. This attack surface database allows for the advanced interactions both inside of ThreadFix and with external tools mentioned above.

Table of Contents