Home page logo

pen-test logo Penetration Testing mailing list archives

RE: tools to scan source code
From: "Benjamin Livshits" <livshits () cs stanford edu>
Date: Fri, 15 Sep 2006 14:11:29 -0700

I would refer to the SAMATE project, which keeps a list of source and binary
analysis tools:



-----Original Message-----
From: listbounce () securityfocus com 
[mailto:listbounce () securityfocus com] On Behalf Of Barrie Dempster
Sent: Thursday, September 14, 2006 4:23 AM
To: pen-test () securityfocus com
Cc: Wahyu Wijaya H.; kish_pent () yahoo com; Stefano Zanero; Ric Messier
Subject: Re: tools to scan source code

Using SWAAT as it comes is not entirely beneficial. The 
matches that come with it in the xml files are extremely 
naive and will false positive a LOT. For example SWAAT will 
pickup "system" as being a vulnerable call to the system 
command, even if it is within a string eg...
echo "Backup the system!" ;

This is just one example, it doesn't analyse the code at all.

Finding Name
 Backup the System
Severity of Finding
 This function appears to issues a command to the operating 
system. If user supplied input is used here it may lead to 
operating system injection attacks. Ensure all such data is validated.

Finding Locations
 In .\system.php, line 2 (context is <?php echo "Backup the 
System"; ?>)

Far too many false positives for this to be a useful static 
analyser. It's not analysing at all, merely grepping - badly.

I'd steer clear of it for now, it could be more useful if you 
knock up your own XML configs, but since it's functionality 
is more limited than grep, you'd be better off just knocking 
up some, grep scripts.
Even `grep system\( *` is a better match and even this is a 
naive filter.
Calling SWAAT a static analyser is a bit of an exaggeration 
of it's current capabilities.

With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue

              - http://reboot-robot.net -

"He who hingeth aboot, geteth hee-haw" Victor - Still Game

This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]