Manual Analysis
This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.
These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
Black Box
Use monitoring tools that examine the software's process as it interacts with the operating system and the network. This technique is useful in cases when source code is unavailable, if the software was not developed by you, or if you want to verify that the build phase did not introduce any new weaknesses. Examples include debuggers that directly attach to the running process; system-call tracing utilities such as truss (Solaris) and strace (Linux); system activity monitors such as FileMon, RegMon, Process Monitor, and other Sysinternals utilities (Windows); and sniffers and protocol analyzers that monitor network traffic.
Attach the monitor to the process and perform a login. Look for library functions and system calls that indicate when privileges are being raised or dropped. Look for accesses of resources that are restricted to normal users.
Note that this technique is only useful for privilege issues related to system resources. It is not likely to detect application-level business rules that are related to privileges, such as if a blog system allows a user to delete a blog entry without first checking that the user has administrator privileges.
Automated Static Analysis - Binary or Bytecode
HighAccording to SOAR [REF-1479], the following detection techniques may be useful:
```
Highly cost effective:
```
Compare binary / bytecode to application permission manifest
```
Cost effective for partial coverage:
```
Bytecode Weakness Analysis - including disassembler + source code weakness analysis
Binary Weakness Analysis - including disassembler + source code weakness analysis
Manual Static Analysis - Binary or Bytecode
SOAR PartialAccording to SOAR [REF-1479], the following detection techniques may be useful:
```
Cost effective for partial coverage:
```
Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Dynamic Analysis with Automated Results Interpretation
SOAR PartialAccording to SOAR [REF-1479], the following detection techniques may be useful:
```
Cost effective for partial coverage:
```
Host-based Vulnerability Scanners - Examine configuration for flaws, verifying that audit mechanisms work, ensure host configuration meets certain predefined criteria
Dynamic Analysis with Manual Results Interpretation
SOAR PartialAccording to SOAR [REF-1479], the following detection techniques may be useful:
```
Cost effective for partial coverage:
```
Host Application Interface Scanner
Manual Static Analysis - Source Code
HighAccording to SOAR [REF-1479], the following detection techniques may be useful:
```
Highly cost effective:
```
Manual Source Code Review (not inspections)
```
Cost effective for partial coverage:
```
Focused Manual Spotcheck - Focused manual analysis of source
Automated Static Analysis - Source Code
SOAR PartialAccording to SOAR [REF-1479], the following detection techniques may be useful:
```
Cost effective for partial coverage:
```
Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer
Automated Static Analysis
SOAR PartialAccording to SOAR [REF-1479], the following detection techniques may be useful:
```
Cost effective for partial coverage:
```
Configuration Checker
Permission Manifest Analysis
Architecture or Design Review
HighAccording to SOAR [REF-1479], the following detection techniques may be useful:
```
Highly cost effective:
```
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Formal Methods / Correct-By-Construction
```
Cost effective for partial coverage:
```
Attack Modeling
