RE: tools to scan source code

["Benjamin Livshits" <livshits () cs stanford edu>]

I would refer to the SAMATE project, which keeps a list of source and binary
analysis tools:

        http://samate.nist.gov/index.php/Tools

Regards,
-Ben 

> -----Original Message-----
> From: listbounce () securityfocus com 
> [mailto:listbounce () securityfocus com] On Behalf Of Barrie Dempster
> Sent: Thursday, September 14, 2006 4:23 AM
> To: pen-test () securityfocus com
> Cc: Wahyu Wijaya H.; kish_pent () yahoo com; Stefano Zanero; Ric Messier
> Subject: Re: tools to scan source code
>
> Using SWAAT as it comes is not entirely beneficial. The 
> matches that come with it in the xml files are extremely 
> naive and will false positive a LOT. For example SWAAT will 
> pickup "system" as being a vulnerable call to the system 
> command, even if it is within a string eg...
> <?php
> echo "Backup the system!" ;
> ?>
>
> This is just one example, it doesn't analyse the code at all.
>
> **********************
> Finding Name
>  Backup the System
>  
> Severity of Finding
>  Medium 
>  
> Description
>  This function appears to issues a command to the operating 
> system. If user supplied input is used here it may lead to 
> operating system injection attacks. Ensure all such data is validated.
>  
>
> Finding Locations
>  In .\system.php, line 2 (context is <?php echo "Backup the 
> System"; ?>)
> **********************
>
> Far too many false positives for this to be a useful static 
> analyser. It's not analysing at all, merely grepping - badly.
>
> I'd steer clear of it for now, it could be more useful if you 
> knock up your own XML configs, but since it's functionality 
> is more limited than grep, you'd be better off just knocking 
> up some, grep scripts.
> Even `grep system\( *` is a better match and even this is a 
> naive filter.
> Calling SWAAT a static analyser is a bit of an exaggeration 
> of it's current capabilities.
>
> --
> With Regards..
> Barrie Dempster (zeedo) - Fortiter et Strenue
>
>               - http://reboot-robot.net -
>
> "He who hingeth aboot, geteth hee-haw" Victor - Still Game


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------