1、berfore we talking abnout the Source Code review,here's what we want to know about the most popular programming langurages .

•      Web application development :Java C#  NET and PHP
•       Drivers and handware C C#   and assembly language
•      Reverse engineering : Assembly langurage
•      Database : Structured Query LangurageSQL
•      Scripting lanurage: Python Perl and Ruby

2、Secure coding cheklist

•     Authentication and credentials must use TLS and not HTTP cleartext
•    Authentication must be enforced on all page ,except the ones intended to the public
•    the erroe messages pages should not lead to information-gathering disclosure
•    Authenticication logic must be validated on the server
•    Authentication passwords must be saved uner secure hashing algorithms and salting is perferable
•    The password's hashing logic must be on the server side
•   Session must be managed on the server side
•    Session idetifier must be random
•   Any cryptographic functionality to protect data shold be implemented on the server side
•   All data validation must be performed on the server side
•   Encode data before validation
•   All validation failures should be rejected in a custom error message
•   Conduct all the encoding logic on the server side
•   Sanitize all the output of understed data foe SQl ,XML LDAP and operating system commands
•   Do not disclose sensitive information in the error messages, including debuffing information such as stack track
•   Use custom reeor messages and error pages
•  Temporary sensitive data must be stored in a secure location ,and those itmes must be purged as soon as possible
•  Remove comments in the source code that may reveal critical information about the application
•  Sensitive information should should not be used in the query sting
•  Data int the  transit must be encrypted with the lasest and greatest TLS algorithms
• Make sure that you remove test codes before deployment

3、Rest API ststus return code (this chapter I've already written about  on my previous blog )

•     200   the action is ok
•     202  the request to create
•     204 the post request did not include a client-generated id
•     400 the request is malformed
•     401 Wrong authentication ID or credentials
•     403 an authenticated user does not have permission to access the resource
•     404 requesting a nonexistant resource
•      405  Unexpected Http method in the request
•     this error may occur when a dos attack is deleted

4、Passive information gathering reconnaissance ----OSINT

       OSINT it mean's  Open Source Intelligence ,let's see the Web search engines

        besides baidu and google 、yahu . i often use the http://yandex.com  and  http://duckduckgo.com  as follow