代码安全审计工具

Posted 2022-07-15 17bdw

免费版本

0×01 php代码审计

1、RIPS

https://sourceforge.net/projects/rips-scanner/，

0×02 Java代码审计

findbugs 代码安全：findsecuritybugs FindSecurityBugs是Java静态分析工具FindBugs的插件

http://findbugs.sourceforge.net/downloads.html https://www.jianshu.com/p/c43940c4e025

https://find-sec-bugs.github.io/

https://wiki.jenkins.io/display/JENKINS/FindBugs Plugin

0×03 其他语言代码审计

1 .net https://security-code-scan.github.io/

2.C++：

代码质量：cppcheck

代码安全： flawfinder https://sourceforge.net/projects/flawfinder/

http://www.doc88.com/p-669125880049.html

https://sourceforge.net/p/flawfinder/feature-requests/4/ xml格式支持

3.JS：

代码质量：eslint

代码安全：https://github.com/ajinabraham/NodeJsScan

https://blog.csdn.net/yalishandalee/article/details/61916454

https://github.com/nodesecurity/eslint-plugin-security#rules

4.Go：

代码质量：golint、go tool vet

代码安全：gas https://github.com/GoASTScanner/gas

5.Python：

代码质量：pylint

代码安全：bandit,py-find-injection，pyt https://wiki.openstack.org/wiki/Security/Projects/Bandit

https://github.com/openstack/bandit

https://github.com/uber/py-find-injection

https://github.com/bit4woo/python_sec https://github.com/python-security/pyt

6.多种语言的安全代码检查工具：sonar https://docs.sonarqube.org/display/SONAR

https://www.sonarsource.com/products/codeanalyzers/sonarjava/rules.html#Vulnerability_Detection

https://github.com/SonarSource/sonarqub

7.ruby https://github.com/thesp0nge/dawnscanner

https://github.com/presidentbeef/brakeman

多种语言

https://github.com/WhaleShark-Team/cobra

正则查找漏洞工具：https://grepbugs.com/

商业化

0x01 商业代码审计工具

静态分析的工具RISP，VCG，Fortify SCA。

动态工具有360的sky wolf。