# Code Analysis

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

## Sourcebot

{% embed url="<https://www.sourcebot.dev/>" %}

## Open Source Analysis

{% embed url="<https://www.yeswehack.com/fr/learn-bug-bounty/open-source-guide-code-analysis>" %}

## Training - Vulnerable Code Snippets

{% embed url="<https://github.com/yeswehack/vulnerable-code-snippets>" %}

## Search for credentials

{% embed url="<https://github.com/m14r41/scan4secrets>" %}

{% content-ref url="recon/osint/credentials-in-git-repos" %}
[credentials-in-git-repos](https://0xss0rz.gitbook.io/0xss0rz/pentest/recon/osint/credentials-in-git-repos)
{% endcontent-ref %}

## XSS in PHP Source Code

```bash
#!/bin/bash

# 1) save it as xssaminer
# 2) allow execution: chmod +x xssaminer
# 3) run it & check usage: ./xssaminer

if [ -z $1 ]
then
	echo -e "Usage:\n$0 FILE\n$0 -r FOLDER"
	exit
else
	f=$1
fi

sources=(GET POST REQUEST "SERVER\['PHP" "SERVER\['PATH_" "SERVER\['REQUEST_U")
sinks=(? echo die print printf print_r var_dump)

xssam(){
	for i in ${sources[@]}
	do
		a=$(grep -in "\$_${i}" $f | grep -o "\$.*=" | sed "s/[ ]\?=//g" | sort -u)

		for j in ${sinks[@]}
		do
			grep --color -in "${j}.*\$_${i}" $f

			for k in $a
			do
				grep --color -in "${j}.*$k" $f
			done
		done
	done
}

if [ $f != "-r" ]
then
	xssam
else
	for i in $(find $2 -type f -name "*.php")
	do
		echo "File: $i"
		f=$i
		xssam
	done
fi

```

{% embed url="<http://brutelogic.com.br/brutal/xssaminer.txt>" %}

{% embed url="<https://brutelogic.com.br/blog/looking-xss-php-source/>" %}

## PHP Code Analysis

{% embed url="<https://ctf-wiki.mahaloz.re/web/php/php/>" %}

## SpotBugs

Java Code

{% embed url="<https://github.com/spotbugs/spotbugs>" %}

## Semgrep

{% embed url="<https://github.com/semgrep/semgrep?tab=readme-ov-file>" %}

{% embed url="<https://payatu.com/blog/semgrep-introduction/>" %}

{% embed url="<https://notsosecure.com/semgrep-practical-introduction>" %}

### Rules - C/C++

{% embed url="<https://github.com/0xdea/semgrep-rules>" %}

### Rules - Python, Javascript/GraphQL, Go, Rust

{% embed url="<https://github.com/trailofbits/semgrep-rules>" %}

### Rules - Java/Android, PHP, Kotlin

{% embed url="<https://github.com/federicodotta/semgrep-rules>" %}

### Rules - Multiple Languages

{% embed url="<https://github.com/semgrep/semgrep-rules>" %}

## Opengrep

{% embed url="<https://github.com/opengrep/opengrep>" %}

## Sonarqube

{% embed url="<https://gist.github.com/dmancloud/0abf6ad0cb16e1bce2e907f457c8fce9>" %}

### Scan

```
osboxes@osboxes:~/Desktop/test$ /opt/sonar-scanner-5.0.1.3006-linux/bin/sonar-scanner   -Dsonar.projectKey=test   -Dsonar.sources=.   -Dsonar.host.url=http://localhost:9000   -Dsonar.token=sqp_298c331b3738f8a44310aece9e2de4008d82cde5
```

{% embed url="<https://www.youtube.com/watch?v=ezMqyPbwxn4>" %}

## Snyk

### Online

Not recommanded or remove sensitive information&#x20;

{% embed url="<https://snyk.io/fr/code-checker/>" %}

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F9K8UKa49Cr1UgoCZXcqP%2Fimage.png?alt=media&#x26;token=e35ece72-fb7e-41a2-81f2-e6beac108372" alt=""><figcaption></figcaption></figure>

### Snyk CLI  <a href="#snyk-cli-commands" id="snyk-cli-commands"></a>

{% embed url="<https://brightsec.com/blog/snyk-cli-quick-guide-installation-and-common-commands/>" %}

{% embed url="<https://app.snyk.io/login>" %}

## CodeQL

{% embed url="<https://codeql.github.com/>" %}

{% embed url="<https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli>" %}

Example with Visual Studio:

{% embed url="<https://www.cyberark.com/resources/threat-research-blog/discovering-hidden-vulnerabilities-in-portainer-with-codeql>" %}

## Vulnhuntr

{% embed url="<https://github.com/protectai/vulnhuntr?s=03>" %}

## PHP Static Analysis Tool

{% embed url="<https://github.com/phpstan/phpstan>" %}

## Dependency Takeover - Node.js

{% embed url="<https://github.com/0xaudron/dependency-takeover>" %}

## List of Static Application Security Testing (SAST) Tools

{% embed url="<https://owasp.org/www-community/Source_Code_Analysis_Tools>" %}

## Resources

### SEI CERT C Coding Standard

{% embed url="<https://wiki.sei.cmu.edu/confluence/plugins/servlet/mobile?contentId=87152044#content/view/87152044>" %}

### SEI CERT C++ Coding Standard

{% embed url="<https://wiki.sei.cmu.edu/confluence/plugins/servlet/mobile?contentId=88046682#content/view/88046682>" %}

### SEI CERT Oracle Coding Standard for Java

{% embed url="<https://wiki.sei.cmu.edu/confluence/plugins/servlet/mobile?contentId=88487702#content/view/88487702>" %}

### OWASP Secure Coding Practices

{% embed url="<https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/>" %}

## Interesting Books

{% content-ref url="../interesting-books" %}
[interesting-books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)