~/bokkapig
hack the box machine writeups
← cd ..

Source Code Analysis

contents
source-code-analysis.md

Source code analysis is the process of examining and reviewing the code of a software program to identify errors, vulnerabilities, and potential improvements. This can be performed manually by developers or through automated tools that scan the code for issues like security risks, coding standard violations, and performance inefficiencies.

AI Analysis#

  • trailofbits/skills - Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows.
npm install -g @github/copilotcopilot/login/model/plugin marketplace add trailofbits/skills/plugin marketplace browse trailofbits/plugin install ask-questions-if-underspecified@trailofbits/plugin install static-analysis@trailofbits/plugin install entry-point-analyzer@trailofbits/plugin install semgrep-rule-creator@trailofbits/plugin install semgrep-rule-variant-creator@trailofbits/plugin install sharp-edges@trailofbits/plugin install insecure-defaults@trailofbits

Semgrep#

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Install:

  • Binaries: opengrep/opengrep / semgrep/semgrep

  • Ubuntu/WSL/Linux/macOS: python3 -m pip install semgrep

  • macOS: brew install semgrep

  • Docker

    docker run -it -v "${PWD}:/src" semgrep/semgrep semgrep logindocker run -e SEMGREP_APP_TOKEN=<TOKEN> --rm -v "${PWD}:/src" semgrep/semgrep semgrep ci

Semgrep rules:

Other Tools:

SonarQube#

Continuous Inspection

Install

  • Docker

    docker run -d --name sonarqube -p 9000:9000 sonarqube:community

Configuration

  • Go to localhost:9000

  • Login with admin:admin

  • Create a local project

  • Generate a token for the project

  • Use sonar-scanner-cli with the generated token

    docker run --rm -e SONAR_HOST_URL="http://10.10.10.10:9000" -v "/tmp/www:/usr/src" sonarsource/sonar-scanner-cli -Dsonar.projectKey=sonar-project-name -Dsonar.sources=. -Dsonar.host.url=http://10.10.10.10:9000 -Dsonar.token=sqp_redacted

  • Check the Security Hotspots tab: http://10.10.10.10:9000/security_hotspots?id=sonar-project-name

:warning: remove dead symbolic links before scanning a folder.

Psalm#

A static analysis tool for finding errors in PHP applications

Install

composer require --dev vimeo/psalm

Configuration

  • Create a project and initiate a scan of the codebase

    ./vendor/bin/psalm --init./vendor/bin/psalm --taint-analysis./vendor/bin/psalm --report=results.sarif

  • Use a Sarif viewer to see the results: microsoft.github.io/sarif-web-component

CodeQL#

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

Install:

Configuration

codeql resolve packscodeql resolve languagescodeql database create <database> --language=<language-identifier>codeql database create --language=python <output-folder>/python-databasecodeql database create --language=cpp <output-folder>/cpp-databasecodeql database analyze <database> --format=<format> --output=<output> <query-specifiers>...codeql database analyze /codeql-dbs/example-repo javascript-code-scanning.qls --sarif-category=javascript-typescript  --format=sarif-latest --output=/temp/example-repo-js.sarifcodeql database analyze <database> microsoft/coding-standards@1.0.0 github/security-queries --format=sarifv2.1.0 --output=query-results.sarif --download

Snyk#

Snyk CLI scans and monitors your projects for security vulnerabilities.

Install

  • Snyk Security - Visual Studio

  • Snyk Code / Snyk Open Source

    curl https://static.snyk.io/cli/latest/snyk-linux -o snykchmod +x ./snykmv ./snyk /usr/local/bin/ docker run -it \    -e "SNYK_TOKEN=<TOKEN>" \    -v "<PROJECT_DIRECTORY>:/project" \    -v "/home/user/.gradle:/home/node/.gradle" \snyk/snyk:gradle:6.4 test --org=my-org-name

Configuration

snyk authsnyk ignore --file-path=<directory_or_file>snyk code test# npm install snyk-to-html -gsnyk code test --json | snyk-to-html -o results-opensource.html

References#