Code Analysis
Static Code Analysis - Tools
Sourcebot
Training - Vulnerable Code Snippets
Search for credentials
Credentials in git reposXSS in PHP Source Code
#!/bin/bash
# 1) save it as xssaminer
# 2) allow execution: chmod +x xssaminer
# 3) run it & check usage: ./xssaminer
if [ -z $1 ]
then
echo -e "Usage:\n$0 FILE\n$0 -r FOLDER"
exit
else
f=$1
fi
sources=(GET POST REQUEST "SERVER\['PHP" "SERVER\['PATH_" "SERVER\['REQUEST_U")
sinks=(? echo die print printf print_r var_dump)
xssam(){
for i in ${sources[@]}
do
a=$(grep -in "\$_${i}" $f | grep -o "\$.*=" | sed "s/[ ]\?=//g" | sort -u)
for j in ${sinks[@]}
do
grep --color -in "${j}.*\$_${i}" $f
for k in $a
do
grep --color -in "${j}.*$k" $f
done
done
done
}
if [ $f != "-r" ]
then
xssam
else
for i in $(find $2 -type f -name "*.php")
do
echo "File: $i"
f=$i
xssam
done
fi
PHP Code Analysis
SpotBugs
Java Code
Semgrep
Rules - C/C++
Rules - Python, Javascript/GraphQL, Go, Rust
Rules - Java/Android, PHP, Kotlin
Rules - Multiple Languages
Sonarqube
Scan
osboxes@osboxes:~/Desktop/test$ /opt/sonar-scanner-5.0.1.3006-linux/bin/sonar-scanner -Dsonar.projectKey=test -Dsonar.sources=. -Dsonar.host.url=http://localhost:9000 -Dsonar.token=sqp_298c331b3738f8a44310aece9e2de4008d82cde5Snyk
Online
Not recommanded or remove sensitive information
Snyk CLI
CodeQL
Example with Visual Studio:
Vulnhuntr
PHP Static Analysis Tool
Dependency Takeover - Node.js
List of Static Application Security Testing (SAST) Tools
Resources
SEI CERT C Coding Standard
SEI CERT C++ Coding Standard
SEI CERT Oracle Coding Standard for Java
OWASP Secure Coding Practices
Interesting Books
Interesting BooksThe Web Application Hacker’s Handbook The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
Real-World Bug Hunting: A Field Guide to Web Hacking Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.
Support this Gitbook
I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.
Last updated