wireghoul / graudit Goto Github PK
View Code? Open in Web Editor NEWgrep rough audit - source code auditing tool
Home Page: http://www.justanotherhacker.com
License: GNU General Public License v3.0
grep rough audit - source code auditing tool
Home Page: http://www.justanotherhacker.com
License: GNU General Public License v3.0
It would be nice to have a folder scan method that would select databases based on the file extension.
Hi,
What is the expected result from a scan? the matched phrases and their location?
Is it possible to get a report of sorts or a vulnerability count?
What's in the default database? because as far as i've seen if i don't choose the right language defaults yields zero results
Are the regular expressions used in the tool borrowed from other tools or made from scratch?
graudit produces a LOT of matches. A lot of it are false positives in files I would not be interested in looking in.
It would be absolutely helpful to include / exclude files based on globbing.
For example:
graudit -I './src/service/**/*.js'
graudit -X '**/node_modules/**'
Hi, first of all thanks for the tool - it looks like it's a very nifty tool. Please excuse the newb question, I am trying to understand if I'm doing something wrong here.
I have a PHP test piece of code, just to see how graudit works. The code is going to be intended for a WordPress site, so I am running
graudit -d wordpress filename.php
Initially the tool outputs this
My understanding is that $_POST is highlighted red because there is no filtering/escaping applied to it.
So, because I am using the wordpress dictionary I add something like sanitize_text_field()
to the input, like so
What I would expect the tool to do now is no longer detect that code snippet as vulnerable as it's been sanitized with a WP function, but it still reports it as such.
Am I getting the wrong end of the stick here?
According to this gist of dangerous PHP functions, a dynamic function dispatch with user supplied input
e.g. $_GET['func']($_GET['arg'])
leads to RCE vulnerabilities.
I'm unsure if there's a pattern for this currently, if there isn't, would the below regex pattern be suitable for inclusion in a PHP signature?
Graudit 1.9 source downloaded from http://www.justanotherhacker.com/projects/graudit/download.html fails to compile when make is run.
$ make
rm -f graudit-*.tar.gz graudit-*.zip
rm -f t/test-results/*
rm -f graudit.1 graudit.7
cat signatures/dotnet/*.db > signatures/dotnet.db
cat signatures/php/*.db > signatures/php.db
cat signatures/perl/*.db > signatures/perl.db
cat signatures/python/*.db > signatures/python.db
cat signatures/asp.db > signatures/all.db
cat signatures/c.db >> signatures/all.db
cat signatures/dotnet.db >> signatures/all.db
cat signatures/default.db >> signatures/all.db
cat signatures/jsp.db >> signatures/all.db
cat signatures/other.db >> signatures/all.db
cat signatures/perl.db >> signatures/all.db
cat signatures/php.db >> signatures/all.db
cat signatures/python.db >> signatures/all.db
cat signatures/*/xss.db > signatures/xss.db
cat signatures/*/sql.db > signatures/sql.db
cat signatures/*/exec.db > signatures/exec.db
nroff -Tascii -mandoc <graudit.in.1 >/dev/null
/bin/sh: graudit.in.1: No such file or directory
Makefile:83: recipe for target 'manpages' failed
make: *** [manpages] Error 1
hi @wireghoul,
Thanks for the nice tool. Can you please let know about the source of the signatures? The signatures in the master branch are years old, may be we should use updated signature if available.
Please, it would be nice to tag the releases in the repository.
I'm currently working on Archlinux packaging because it is broken.
First, ensure you have cloned the graudit repository:
git clone https://github.com/wireghoul/graudit
cd graudit
According to the instructions, you can install graudit either for a user or globally. To install it globally, you typically need to run:
sudo make install
If you prefer to install it for your user only, run:
make userinstall
If make install
or make userinstall
completes without errors, graudit should now be installed on your system.
echo 'PATH="$HOME/graudit:${PATH:+:${PATH}}"; export PATH;' >> ~/.bashrc
export GRDIR="$HOME/graudit/signatures"
source ~/.bashrc
Check if graudit is now recognized as a command:
graudit
If graudit is installed correctly and in your PATH, it should display its help and options without errors.
Just to let you know that the version of grep that I am using does not have --exclude-dir option in this version. Below is the output from running graudit.
-bash-3.2# ./graudit -d php /tmp/www.of-networks.co.uk
grep: unrecognized option `--exclude-dir=.svn'
Usage: grep [OPTION]... PATTERN [FILE]...
Try `grep --help' for more information.
-bash-3.2# grep --version
grep (GNU grep) 2.5.1
Copyright 1988, 1992-1999, 2000, 2001 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-bash-3.2#
Having looked through the code you may want to consider using just the grep --exclude option and passing a regex of the svn cvs and git dirs. This should achieve the same thing.
So passing grep the following:
--exclude="*\.svn" \
--exclude="*\.cvs" \
--exclude="*\.git" \
Have made the modification to graudit and tested it on my version and those option parameters are working, so I will fork the file and update this issue.
Hi,
thanks for the tool first!
Besides manual grepping I am using it currently to spot potential candidates for SQL injections in a LAMP stack.
What I miss is querying PHP files only, so basically the opposite of '-x' as it finds JS files and throws ugly remarks to stderr for binary files like pictures. Same would probably apply for other languages too.
Cheers, Dirk
* FAIL 1: 1
whitespace test test `../graudit -c 0 -d ../signatures/php.db whitespace.php | wc -l` -eq 2
* ok 2: exec test
* failed 1 among 2 test(s)
On mac High Sierra, trying to build graudit.
First tried make
and it errored on the git test #1.
Commented out that test and it went forward. Sorry don't have time to give complete details but it seems like missing configure.ac
might be the problem. How would I go about generating that / what is the correct build process for graudit?
I'm using Graudit with various source codes for testing purposes. I found problems with false positives but I'm not sure how should I improve the databases so I could fix some issues.
The following code is part of a52dec:
static inline ao_instance_t * ao_open (ao_open_t * open)
{
return open ();
}
With the open\s*\(
pattern, declaration of ao_open
is detected as vulnerable when it clearly isn't. Furthermore the call to open
inside this function is also not vulnerable but again it is a false positive.
For the first problem I think we should check for for an exact open instead for open preceded by anything. Particular cases such as something=open(...
should be taken into account.
For the second a minimal check for the correct amount of parameters could work.
What do you think?
.___ __ __
_________________ __ __ __| _/|__|/ |_
/ ___\_` __ \__ \ | | \/ __ | | \\_ __\
/ /_/ > | \// __ \| | / /_/ | | || |
\___ /|__| (____ /____/\____ | |__||__|
/_____/ \/ \/
grep rough audit - static analysis tool
v2.4 written by @Wireghoul
=================================[justanotherhacker.com]===
./index.php-33-
This repository doesn't use semantic versioning. It really should, as that would allow graudit to exist in package managers so it can be updated more easily.
For example: 3.5
would become 3.5.0
Hi,
I was struggling in a project to find OO queries which weren't safe. If I didn't overlook anything, graudit didn't help me much.
So I ended up using grep myself to identify statements like "$db_handle->query($unsafe)"
(which wasn't easy as either there were too many false positives or negatives, depending on my quick choice of grep patterns).
Any chance for a pattern to catch this unsafe OO queries somehow ?
Cheers, Dirk
When I did make install
in cygwin I only got the error ./runtests.sh: line 3: $'\r': command not found
To fix it I used the command dos2unix graudit/*; make install
.
Then it works perfectly.
So I suggest to include the command dos2unix in the make for cygwin or to directly avoid windows style newline characters.
Describe the bug
ECANTPARSEGRAUDIT.7
To Reproduce
Steps to reproduce the behavior:
man 7 graudit
Expected behavior
Show something more useful
Actual behavior
It says iblahblahblahblah blahblhablhablhablhablhab
Debugging
not applicable
Please complete the following information
I am trying to run a scan on some files, but after I submit the command, it just instantly goes to accepting more input and does not display any errors or results from any scan that might've run, without any indication whatsoever what may have happened. Honestly, the "documentation" for this tool is pretty poor, so trying to find answers and help with this has not been easy.
Note: I have blackened several areas of the image for sensitivity purposes, but the important aspects such as location of DB and commands used are there. I am running this on Windows as that is my native OS from which I work on, and the path to the directory is done using "C:/Users/[user]/path/to/directory" as stated.
Maybe some rules of use in here:
https://littlemaninmyhead.wordpress.com/2019/08/04/dont-underestimate-grep-based-code-scanning/
Rule list is at the end.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.