Secure Your Software with SWAMP

Posted on by Leave a comment

SWAMP Secure Your Software Gear Logo

 

What’s hiding in your code?

Discover bad coding practices, bugs, weaknesses, and vulnerabilities by scanning your own software or software that you’d like to use in the SWAMP. There are two ways to use the SWAMP: the ready-to-use cloud computing platform at mir-swamp.org or by downloading the SWAMP-in-a-Box (SiB) open-source distribution. SWAMP also has a Java command line interface, a GitHub webhook, and plugins for Jenkins, Eclipse, and Git/SVN.

Use the SWAMP in 3 simple steps:

1) Upload a package.
2) Run assessments.
3) View results.

SWAMP Update 1.34.2

Posted on by Leave a comment

The following SWAMP updates are now available for mir-swamp.org and SWAMP-in-a-Box. The latest SWAMP-in-a-Box version 1.34.2 files can be obtained from the download server or GitHub.

Noteworthy changes include:New

  • Improvements to the SWAMP’s Native Results Viewer.
    • The weaknesses shown can now be filtered by bug type.
    • The locations of weaknesses within the affected code files are shown. Specifically, each weakness listed provides a link to a page showing the code file in which that weakness is located with the specific line of code flagged. Additionally, the Native Viewer has a tree view of the files and directories included in the package archive and provides a count of weaknesses per file and a code view of files with all weaknesses flagged.
  • General enhancements and bug fixes for SWAMP-in-a-Box.
    • SWAMP-in-a-Box user sign-in works when using an Active Directory server with multiple, hierarchical DNs (distinguished names).
    • SWAMP-in-a-Box assessments run for users where the user_uid includes an “@” character, which happens when SWAMP-in-a-Box uses an LDAP/AD server for user authentication and the SWAMP User ID maps to an LDAP/AD attribute that has values containing an “@”.
    • You can now specify when the SWAMP layout cookie expires in number of days. Use an integer value for cookie.expires in the web front end configuration file (/var/www/html/config/config.json).
    • The SWAMP-in-a-Box web server no longer includes access-control related headers in responses if the APP_CORS_URL is the same as APP_URL in the .env configuration file (/var/www/swamp-web-server/.env).
    • The upgrade script has been updated to prevent problems with a SWAMP-in-a-Box install not including tool metadata records. When creating an assessment, platforms can now be selected for individual tools.

Let us know if you have any questions at support@continuousassurance.org.

Hosted .NET Packages for Testing on MIR-SWAMP

Posted on by Leave a comment

The Software Assurance Marketplace now hosts a curated collection of .NET software packages for testing on mir-swamp.org. These packages can be viewed under Resources > Packages > filter on the .NET package type. Log in to your SWAMP account to run assessments of these packages with the .NET tools currently supported in the SWAMP.

SWAMP Packages page showing filtered .NET package types

SWAMP-in-a-Box Update 1.34.1

Posted on by Leave a comment

SWAMP-in-a-Box version 1.34.1 is now available! The latest files can be obtained from the SWAMP-in-a-Box download server now or found on GitHub in the next few days.

Noteworthy changes include:New

  • SWAMP-in-a-Box now supports Code Dx version 3.5.5 to view results. You must obtain Code Dx separately from Code Dx, Inc. Please refer to the SWAMP-in-a-Box Administrator Manual for details on how to install Code Dx as an additional results viewer. If you have added Code Dx 2.8.3 to an existing SWAMP-in-a-Box installation, adding Code Dx 3.5.5 will automatically replace the older version with Code Dx 3.5.5.
  • General enhancements and bug fixes.

Let us know if you have any questions at sib@continuousassurance.org.

« Older Entries Recent Entries »