veracode-demo-labs.github.io
| Return to Home | Return to GitHub/Veracode-Demo-Labs |
Visual Studio 2022
Open the VeraDemo-DotNet project.
Try to build the solution and make sure the project builds properly before proceeding.
Submit Greenlight IDE Static scan
See more about Greenlight here - https://docs.veracode.com/r/c_master_greenlight
Right-click the Controllers folder and click Scan with Veracode Greenlight.
The bottom left shows a messaging stating “Scanning Controllers”.
SAST results are returned. Review the results and the remediation details link.
Submit a SAST/SCA Sandbox scan
Click the Veracode Static Scan tab on the bottom, or click Extensions -
A wizard will pop up to help configure the project.
Go to the Veracode platform and create a new application profile and a new Sandbox in that profile.
The wizard will allow you to select that profile and sandbox.
This is the Veracode scan configuration files stored with the project.
Run the Package step to create a artifact of the DotNet app for scanning.
Click the Run Scan button to submit a SAST/SCA sandbox scan.
Remediate | re-scan | no new flaws
While we wait a few minutes for that to complete, lets fix a SQLi issue and resubmit the scan. In HomeController.cs, comment out the two bad code sections, and uncomment the two good code sections.
Should look like this.
Click the V in the toolbar to scan the file with Greenlight. You can monitor the output folder to see it running.
You should see the SQLi now removed from the Veracode Greenlight Findings tab.
Lets submit another version to the sandbox without the SQLi. First make sure the existing scan completed (should take a few minutes).
Once completed we can submit a new sandbox scan. While you are here, click into the sandbox to review the report.
This is the Triage Flaws view.
Back to the Veracode Static Anlasys tab we can submit another version to the sandbox. Click Publish and Package.
Then Run Scan.
Click Extensions - Veracode Static Analysis - View Results - View Results (Sandbox) to download the findings from our first scan. The SQLi exists.
Once the second sandbox scan completes, download the results again.
The SQLi is now gone.
Visit the sandbox to see two completed scans.
Click Results Latest on the left side to see that one issue has been fixed.
While you are here, review the Software Composition Analysis page.
Next steps would be:
- Remediate or mitigate any issues that violate policy
- Automate scans via CI/CD to prevent new flaws from being committed.
- Connect bug tracking systems to establish a continuos feedback loop of any issues.
- Establish a recurring DAST scan.
- Developer training
| Return to Home | Return to GitHub/Veracode-Demo-Labs |