O2 .NET AST Scanner - HacmeBank Example

From

The following screenshots show the O2's .NET Scanner in action on the HacmeBank's source code

Contents 1 Part 1 : create the MethodStream 2 Part 2: Create the CodeStream 3 Part 3: Following Taint Step by Step 4 Part 4: Graph with trace

Part 1 : create the MethodStream

A MethodStream is a file which contains all methods that are called from a particular source method.

For example the HacmeBank's WebService method:

who calls the DataFactory method:

who calls the SqlEngine method:

So, in this case the MethodStream for the CreateUser WebService method looks like this:

and

(the above auto generated methods are methods that the engine was able to resolve but the source code was not available)

Part 2: Create the CodeStream

The CodeStream is a unique data-flow path created from a starting point inside a provided MethodStream

Part 3: Following Taint Step by Step

• step 1:

• step 2:

• step 3:

• step 4:

• step 5:

• step 6:

• step 7:

• step 8:

• step 9:

Part 4: Graph with trace