Checklist to perform a source code review
On binsec.wiki you can find a structured checklist for evaluating source code security as part of technical assessments. It follows established standards such as the OWASP Top 10 and PCI DSS and is used by binsec during code reviews to systematically identify and document security-relevant weaknesses. Clients can also use the checklist to prepare for a penetration test of a web application or API, helping them identify common vulnerabilities in advance.
The checklist covers the following test areas:
- Test Object 1 – Communication
- Test Object 2 – Authentication
- Test Object 3 – Session Management
- Test Object 4 – Authorization
- Test Object 5 – Error Handling
- Test Object 6 – Data Validation
- Test Object 7 – Data Storage
- Test Object 8 – Logging
- Test Object 9 – Software Components
- Test Object 10 – API Security
- Test Object 11 – Cryptography
Provide knowledge
Our Wiki
This is our binsec wiki page.
On binsec.wiki you can find a structured checklist for evaluating source code security. Based on established standards such as the OWASP Top 10 and PCI DSS, it helps developers and security teams identify common vulnerabilities early. The checklist is used by binsec during code reviews and can also be applied to prepare for security assessments of web applications and APIs.
The "Hacking I: Scanning Networks" chapter of binsec.wiki's Pentest Training covers the critical first step in penetration testing: network reconnaissance. This phase involves mapping the attack surface by identifying active hosts, open ports, and the services running on those ports within a target network.
The "Hacking II: Password Attacks" chapter of binsec.wiki's Pentest Training delves into a critical aspect of penetration testing: exploiting weak or compromised passwords to gain unauthorized access. The chapter distinguishes between online and offline password attacks.
The Binsec Wiki’s "Hacking III: Web Application Attacks" explains that web apps with password-based roles expose a wide attack surface via forms, headers, and cookies. Client-side checks can be bypassed with tools like Burp Suite. Testing then focuses on common but critical flaws: SQL Injection (SQLi) and Cross-Site Scripting (XSS) - still among the most prevalent threats per OWASP.
Penetration Testing
Since 2013 we conduct professional penetration test, based on international industry standards and years of experience in penetration testing, red teaming and hacking.
As a company for professional penetration testing, we do some things differently than other pentest provider: As a penetration test firm, we do not sell vulnerability scans as pentest. We do also focus on business security risks. You are looking for a professionally conducted penetration tests? Get the binsec team for your Pentest. Read more about our pentest service.
Contact us
+49 692475607-0