Some technical details on how XSSDetect does Dataflow Analysis

Update: Some details on how XSSDetect does dataflow analysis

ACE Team - Security, Performance & Privacy — Wed, 24 Oct 2007 10:09:55 GMT

Just a brief update, Hassan Khan one of the lead developers of XSSDetect and part of our ACE Engineering

Some details on how XSSDetect does dataflow analysis

Ravikanth's Blog — Wed, 24 Oct 2007 13:06:21 GMT

ACE Engineering team has posted up some technical details on how XSSDetect uses data flow analysis to

re: Some technical details on how XSSDetect does Dataflow Analysis

orysegal — Wed, 24 Oct 2007 16:44:39 GMT

Quote: "Most tools in the market, if not all, are not very good at it. Static analysis tools on the other hand scan the application source code or binaries to detect programming errors. Consequently, they offer 100% coverage and are able to identify many more vulnerabilities than penetration testing tools. XSSDetect is a static analysis tool. "

Harsh words, and without a lot of basis on real facts if I may add. Ask around actual customers of source code analysis tools, and they will bitch and complain about the amount of false positives and noise that these tools produce.

Preferring whitebox over blackbox is ridiculous. One technique on its own will never be able to provide 100% security coverage.

[ASP.NET] XSS Detect (beta)

biac のそれさえもおそらくは幸せな日々@nifty — Thu, 25 Oct 2007 10:44:05 GMT

MS ダウンロードセンターより。 XSS Detect Beta Code Analysis Tool Version: 1.0Date Published:

XSSDetect: Cross Site Scripting detection plug-in for Visual Studio 2005

Blake Niemyjski — Thu, 25 Oct 2007 18:28:09 GMT

The "Ace" team inside of Microsoft has kindly released a plug-in for Visual Studio called XSSDetect

XSSDetect : première beta publique de l'outil d'analyse statique disponible

CoqBlog — Sun, 28 Oct 2007 15:26:03 GMT

XSSDetect est un addin pour Visual Studio destiné à aider l'utilisateur à éliminer les problèmes d' XSS

Link to public beta of XSSDetect cross-site scripting code analysis plug-in for Visual Studio 2005

Aaron Stebner's WebLog — Mon, 29 Oct 2007 04:57:23 GMT

I ran across a few interesting posts on the Application Consulting and Engineering (ACE) team's blog