Vulny-Code-Static-Analysis

Python script to detect vulnerabilities inside PHP source code using static analysis, based on regex

Go to file

Swissky e6fcd0d3ca Semgrep rules to replace this script		2022-04-30 15:00:48 +02:00
.github	Update FUNDING.yml	2021-01-08 20:51:49 +01:00
semgrep	Semgrep rules to replace this script	2022-04-30 15:00:48 +02:00
utils	Fix maximum recursion error + catch hardcoded password in define()	2020-01-09 22:59:26 +01:00
vulns	Semgrep rules to replace this script	2022-04-30 15:00:48 +02:00
.gitignore	Check for constant var	2017-11-14 11:10:21 +01:00
LICENSE	License added	2017-05-27 21:05:28 +02:00
README.md	Semgrep rules to replace this script	2022-04-30 15:00:48 +02:00
detection.py	XXE / SSRF / Cookies and more use-cases	2020-09-29 14:08:36 +02:00
functions.py	Fixes for errors by pycodestyle (except E501) to run it	2019-04-05 16:32:45 +02:00
index.py	Fix maximum recursion error + catch hardcoded password in define()	2020-01-09 22:59:26 +01:00
indicators.py	Feat: add debug_print_backtrace to the list of info leak indicators	2020-10-02 10:50:53 +02:00

README.md

⚠️ Deprecated, you should use semgrep rules instead of this script: semgrep --config=./semgrep/ vulns/*.php Most of the semgrep rules provided in this repository are from https://github.com/returntocorp/semgrep-rules

Basic script to detect vulnerabilities into a PHP source code, it is using Regular Expression to find sinkholes.

# HELP
╭─ 👻 swissky@crashlab: ~/Github/PHP_Code_Static_Analysis  ‹master*›
╰─$ python3 index.py           
usage: index.py [-h] [--dir DIR] [--plain]

optional arguments:
  -h, --help  show this help message and exit
  --dir DIR   Directory to analyse
  --plain     No color in output

# Example
╭─ 👻 swissky@crashlab: ~/Github/PHP_Code_Static_Analysis  ‹master*›
╰─$ python3 index.py --dir vulns    
------------------------------------------------------------
Analyzing 'vulns' source code
------------------------------------------------------------
Potential vulnerability found : File Inclusion
Line 19 in vulns/include.php
Code : include($_GET['patisserie'])
------------------------------------------------------------
Potential vulnerability found : Insecure E-mail
Line 2 in vulns/mail.php
Code : mail($dest, "subject", "message", "", "-f" . $_GET['from'])
Declared at line 1 : $dest = $_GET['who'];

Currently detecting :

Arbitrary Cookie
Arbitrary File Deletion
Arbitrary Variable Overwrite
Cross Site Scripting
File Inclusion
File Inclusion / Path Traversal
File Upload
Header Injection
Information Leak
Insecure E-mail
Insecure Weak Random
LDAP Injection
PHP Object Injection
Remote Code Execution
Remote Command Execution
Server Side Request Forgery
Server Side Template Injection
SQL Injection
URL Redirection
Weak Cryptographic Hash
XML external entity
XPATH Injection
Hardcoded credentials
High Entropy string

if you want to export each vulnerabilities type into a folder use the "export.sh"

Don't forget to read the license ;)

README.md Unescape Escape

VulnyCode - PHP Code Static Analysis - Deprecated

Alternatives

README.md