How to Use YASCA Static Code Analysis Tool

Total Page：16

File Type：pdf, Size：1020Kb

How to use YASCA static code analysis tool Yasca which is an acronym for “Yet Another Source Code Analyzer” is an open source program which looks for security vulnerabilities, code-quality, performance, and conformance to best practices in program source code. It leverages external open-source programs, such as FindBugs, PMD, JLint, JavaScript Lint, PHPLint, Cppcheck, ClamAV, Pixy, and RATS to scan specific file types. It also contains many custom scanners developed for Yasca. It is a command-line tool that generates reports in HTML, CSV, XML, MySQL, SQLite, and other formats. Languages Scanned with Yasca Yasca has at least one scanner for each of the following file types: DotNET (VB.NET, C#, ASP.NET), ASP, C/C++, COBOL, ColdFusion, CSS, HTML Java,JavaScript, Perl, PHP, Python, Raw HTTP Traffic, Visual Basic In this post we will be looking at how to install and use Yasca source code analyser. To understand more about source code analyzers click on this link to my previous post on Understanding Static Code Analysis Download Yasca fromhttps://sourceforge.net/projects/yasca/?source=typ_redirect Extract it to any location of your choice. In this post I will be using C:\YASCA © Assurecondo How to use YASCA static code analysis tool How to use YASCA static code analysis tool You will need to download the following 11 plugins1. yasca-2.1-jlint.zip2. yasca-2.1- javascriptlint.zip3. yasca-2.1-fxcop.zip4. yasca-2.1-findbugs.zip5. yasca-2.1- rats.zip6. yasca-2.1-pmd.zip7. yasca-2.1-findbugs-plugin.zip8. yasca-2.1- pixy.zip9. yasca-2.1-phplint.zip10. yasca-2.1-cppcheck.zip11. yasca-2.1-clamav.zip This can be downloaded from the following links:https://sourceforge.net/projects/yasca/files/Yasca%202.x/Yasca%202.1/ Create a folder called STATIC_TOOLS and unzip the downloads into it. For this post, I will create my STATIC_TOOLS folder in my C:\YASCA directory. My final location for the static_tools folder is C:\YASCA\Static_tools\ Please note that all your plugins must be extracted to this location as we will point the Yasca engine to pick the plugins from this location. Using YASCA Usage is through command prompt as usual. I will guide you carefully. Now that we have already extracted our plugins to our desired location we can begin. We need to first of all point the YASCA engine to the location of the plugins to be used for the source code scan. This is done with the following commands set SA_HOME=C:\YASCA\Static_tools\ © Assurecondo How to use YASCA static code analysis tool How to use YASCA static code analysis tool The Yasca installation file has test source code that can be used for training which can be located atresources\test in mine the location isC:\YASCA\resources\test Now run the following command to perform the source code scan yasca C:\YASCA\resources\test © Assurecondo How to use YASCA static code analysis tool How to use YASCA static code analysis tool Result of the source code scan will be reported in the directory given after the entire scan as can be seen in the highlighted part of the screen shot This is a screen shot of my results Open the HTML file and you will have a detailed report of the source code analysis © Assurecondo How to use YASCA static code analysis tool How to use YASCA static code analysis tool The coloured square dots are descriptive and can be clicked on. Please see the screen shot for what they stand for: And that’s how to use YASCA. I hope you enjoyed this post and also hope it was value adding. I would appreciate your comments or contributions © Assurecondo How to use YASCA static code analysis tool.

Copy Link

Recommended publications

Static Analysis the Workhorse of a End-To-End Securitye Testing Strategy
Static Analysis The Workhorse of a End-to-End Securitye Testing Strategy Achim D. Brucker [email protected] http://www.brucker.uk/ Department of Computer Science, The University of Sheffield, Sheffield, UK Winter School SECENTIS 2016 Security and Trust of Next Generation Enterprise Information Systems February 8–12, 2016, Trento, Italy Static Analysis: The Workhorse of a End-to-End Securitye Testing Strategy Abstract Security testing is an important part of any security development lifecycle (SDL) and, thus, should be a part of any software (development) lifecycle. Still, security testing is often understood as an activity done by security testers in the time between “end of development” and “offering the product to customers.” Learning from traditional testing that the fixing of bugs is the more costly the later it is done in development, security testing should be integrated, as early as possible, into the daily development activities. The fact that static analysis can be deployed as soon as the first line of code is written, makes static analysis the right workhorse to start security testing activities. In this lecture, I will present a risk-based security testing strategy that is used at a large European software vendor. While this security testing strategy combines static and dynamic security testing techniques, I will focus on static analysis. This lecture provides a introduction to the foundations of static analysis as well as insights into the challenges and solutions of rolling out static analysis to more than 20000 developers, distributed across the whole world. A.D. Brucker The University of Sheffield Static Analysis February 8–12., 2016 2 Today: Background and how it works ideally Tomorrow: (Ugly) real world problems and challenges (or why static analysis is “undecideable” in practice) Our Plan A.D.
[Show full text]
List of Requirements for Code Reviews
WP2 DIGIT B1 - EP Pilot Project 645 Deliverable 9: List of Requirements for Code Reviews Specific contract n°226 under Framework Contract n° DI/07172 – ABCIII April 2016 DIGIT Fossa WP2 – Governance and Quality of Software Code – Auditing of Free and Open Source Software. Deliverable 9: List of requirements for code reviews Author: Disclaimer The information and views set out in this publication are those of the author(s) and do not necessarily reflect the official opinion of the Commission. The content, conclusions and recommendations set out in this publication are elaborated in the specific context of the EU – FOSSA project. The Commission does not guarantee the accuracy of the data included in this study. All representations, warranties, undertakings and guarantees relating to the report are excluded, particularly concerning – but not limited to – the qualities of the assessed projects and products. Neither the Commission nor any person acting on the Commission’s behalf may be held responsible for the use that may be made of the information contained herein. © European Union, 2016. Reuse is authorised, without prejudice to the rights of the Commission and of the author(s), provided that the source of the publication is acknowledged. The reuse policy of the European Commission is implemented by a Decision of 12 December 2011. Document elaborated in the specific context of the EU – FOSSA project. Reuse or reproduction authorised without prejudice to the Commission’s or the authors’ rights. Page 2 of 51 DIGIT Fossa WP2 – Governance and Quality of Software Code – Auditing of Free and Open Source Software. Deliverable 9: List of requirements for code reviews Contents CONTENTS............................................................................................................................................
[Show full text]
Book of Abstracts
|zchhppts||jj fivétqrujznéqjsvkÂîñüìîé Ìåæäóíàðîäíîé«¯®µ¦±¦®·©© ±¡¨±¡¢¯³¸©«¯£©°¯¬½¨¯£¡³¦¬¦ª ²£¯¢¯¥®¯¤¯ °±¯¤±¡®¯¤¯¯¢¦²°¦¸¦®©À /LQX[9DFDWLRQ(DVWHUQ(XURSH2 ¤±¯¥®¯07Ĕ10èþíÿ2¤ ±¦²³ l¬½³¦±®¡³©£¡| 2 ÏbÇ ÈÈÇ¹ Ì ºąºË®¯ËąÈ}ĆÒË®ikzº°Ċ}È cËąÈ}ĆÒºÓÓÈ«}ºããËĄÒ«ikzº°Ċ}sslÈ¯ÎÈÓ ik©Óĉ}ÒÓk|bÈą¯È cËĆËÓÏËÓ© Ñ.Ñ. Äåðå÷åííèê, êàíäèäàò òåõíè÷åñêèõ íàóê, äîöåíò, çàâåäóþùèé êàôåäðîé ýëåêòðîííûõ âû÷èñëèòåëüíûõ ìàøèí è ñèñòåì Áðåñòñêîãî ãîñóäàðñòâåííîãî òåõíè÷åñêîãî óíèâåðñèòåòà À.Â. Îòâàãèí, êàíäèäàò òåõíè÷åñêèõ íàóê, äîöåíò êàôåäðû ýëåêòðîííûõ âû÷èñëèòåëüíûõ ìàøèí Áåëîðóññêîãî óíèâåðñèòåòà èíôîðìàòèêè è ðàäèîýëåêòðîíèêè Ì |}¯©©ËË²ÓºãºĄÒÒñ¢¯±®©«¡³¦±©¡¬¯£ÂîñüìîéÌ¦§¥´- ®¡±¯¥®¯ª «¯®µ¦±¦®·©© ±¡¨±¡¢¯³¸©«¯£ ©°¯¬½¨¯£¡³¦¬¦ª²£¯- ¢¯¥®¯¤¯ °±¯¤±¡®¯¤¯ ¯¢¦²°¦¸¦®©À /LQX[ 9DFDWLRQ (DVWHUQ (XURSH2±¯¥®¯0710èþíÿ 2¤ °¯¥ ¯¢º¦ª ±¦¥ ¯²³¿«¡Ĕ±¦²³¬½³¦±®¡³©£¡Ĕ160² ,6%13070 Æxivétqrkv¡squjznéqjs, ïðåäñòàâëåííûå àâòîðàìè íà Âîñüìóþ Ìåæäóíàðîäíóþ êîíôåðåíöèþ ðàçðàáîò÷èêîâ è ïîëüçîâàòåëåé ñâîáîäíîãî ïðîãðàììíîãî îáåñïå÷åíèÿ Linux Vacation / Eastern Europe 2012, âêëþ÷àÿ âûåçäíóþ çèìíþþ ñåññèþ êîíôåðåíöèè LVEE Winter 2012. Ìàòåðèàëû äîêëàäîâ ïðåäñòàâëåíû íà ñàéòå êîíôåðåíöèè http://lvee.org è ðàñïðîñòðàíÿþòñÿ ïîä ëèöåíçèåé Creative Commons Attribution-ShareAlike 3.0. Ñòàòüè ïîñâÿùåíû íîâûì òåõíîëîãèÿì è ðàçðàáîòêàì â ñôåðå ñâîáîäíîãî (îòêðûòîãî) ïðîãðàììíîãî îáåñïå÷åíèÿ è çàòðàãèâàþò øèðîêèé ñïåêòð ïëàòôîðì – îò ðàáî÷èõ ñòàíöèé è ñåðâåðîâ, âêëþ÷àÿ ðåøåíèÿ íà áàçå âèðòóàëèçàöèè, äî âñòðàèâàåìûõ ñèñòåì è ìîáèëüíûõ óñòðîéñòâ. Ñáîðíèê ìîæåò áûòü èíòåðåñåí ñïåöèàëèñòàì â îáëàñòè èíôîðìàöè-
[Show full text]
Code Review Guide
CODE REVIEW GUIDE 2.0 RELEASE Project leaders: Larry Conklin and Gary Robinson Creative Commons (CC) Attribution Free Version at: https://www.owasp.org 1 F I 1 Forward - Eoin Keary Introduction How to use the Code Review Guide 7 8 10 2 Secure Code Review 11 Framework Specific Configuration: Jetty 16 2.1 Why does code have vulnerabilities? 12 Framework Specific Configuration: JBoss AS 17 2.2 What is secure code review? 13 Framework Specific Configuration: Oracle WebLogic 18 2.3 What is the difference between code review and secure code review? 13 Programmatic Configuration: JEE 18 2.4 Determining the scale of a secure source code review? 14 Microsoft IIS 20 2.5 We can’t hack ourselves secure 15 Framework Specific Configuration: Microsoft IIS 40 2.6 Coupling source code review and penetration testing 19 Programmatic Configuration: Microsoft IIS 43 2.7 Implicit advantages of code review to development practices 20 2.8 Technical aspects of secure code review 21 2.9 Code reviews and regulatory compliance 22 5 A1 3 Injection 51 Injection 52 Blind SQL Injection 53 Methodology 25 Parameterized SQL Queries 53 3.1 Factors to Consider when Developing a Code Review Process 25 Safe String Concatenation? 53 3.2 Integrating Code Reviews in the S-SDLC 26 Using Flexible Parameterized Statements 54 3.3 When to Code Review 27 PHP SQL Injection 55 3.4 Security Code Review for Agile and Waterfall Development 28 JAVA SQL Injection 56 3.5 A Risk Based Approach to Code Review 29 .NET Sql Injection 56 3.6 Code Review Preparation 31 Parameter collections 57 3.7 Code Review Discovery and Gathering the Information 32 3.8 Static Code Analysis 35 3.9 Application Threat Modeling 39 4.3.2.
[Show full text]
Introduction to Yasca
Introduction To Yasca Presented at NYPHP 24 February 2009 Michael V. Scovetta Agenda . Who Am I? . What is Yasca? . How does it work? . Requirements . How should I use it? . The Future of Yasca . Demonstration . Questions? 2 Who Am I? . Development . CA ~2002 . Perl, Java, PHP . Information Security . UBS ~2005 . Security Consulting . Cigital ~2008 . Architecture . CA ~2008 3 What is Yasca? . Yasca started as a set of perl scripts that grepped through source code looking for XSS vulnerabilities. <%=request.getParameter("foo")%> . <?=$_REQUEST["foo"]?> . Then I needed to do multi-line searches: . String s = request.getParameter("foo"); out.println(s); . As I wrote more rules, I found other scanners that already had many of them. So I made calls out to them. Then everything got nasty and I wrote it all from scratch again in PHP. 4 What is Yasca? . Yasca is an open-source tool that can help you analyze program source code. It leverages several static analysis tools. PMD (http://pmd.sourceforge.net/) . J-Lint (http://artho.com/jlint/) . Pixy (http://pixybox.seclab.tuwien.ac.at/pixy/) . FindBugs (http://findbugs.sourceforge.net/) . It can be used to scan virtually any file type, not only traditional source code. Yasca is written in command-line PHP and released under the BSD license. 5 How Does it Work? . Architecture based on plug-ins. "Major Plug-in" => calls another tool to do the scan . e.g. PMD, J-Lint, FindBugs, Pixy, Grep . "Minor Plug-in" => uses embedded logic . Relatively easy to write, extremely flexible Report Plug-in Yasca Plug-in Generator Plug-in Output /tmp/my_source_code 6 How Does it Work .
[Show full text]
Partitioners Track: Generating Security Vulnerabilities in Source Code
M. Meier,D.Reinhardt, S. Wendzel (Hrsg.): Sicherheit 2016, Lecture Notes in Informatics (LNI), Gesellschaft fur¨ Informatik, Bonn 2016 177 Partitioners Track: Generating Security Vulnerabilities in Source Code Felix Schuckert1 Abstract: This paper describes aframework, which modifies existing source code to generate secu- rity issues. An example plugin for generating SQL injection in Java source code is described. The generation process is based on static code analysis techniques likedataflowanalysis and abstract syntax trees. The framework is evaluated with the help of Java projects from GitHub.One modified project wassuccessfully used in acapture the flag event as achallenge. Keywords: Software security,sql injection, generating, static code analysis 1Introduction Modern software products usually have aconnection to the internet. All of them are ex- posed to attackers that want to exploit the software. The top security issues remained the same overthe last years. Software developers have to protect their software from attackers by developing secure software. As stated in the paper [PE09], software security can’tbe provided only by the operating system. The software must have no vulnerabilities as well. Developers usually write tests, if common security vulnerabilities in their programs do exist, butthis will not guarantee the security of the developed software. Instead it will ve- rify the defined function requirements [Ba]. Static code analyzer tools help to find existing security issues in source code. These issues have to be reviewed and fixed manually by software developers. Fixing such issues requires ahigh amount of skill in software secu- rity.Another problem is that some security issues might not be detected by using code analyzer.Atbest all software developers should have software security skills to prevent software security issues preemptively in the development process.
[Show full text]
Evaluation of Automated Static Analysis Tools Cathleen L
GSTF Journal on Computing (JoC) Vol.2 No.1, April 2012 Performance Evaluation of Automated Static Analysis Tools Cathleen L. Blackmon, Daisy F. Sang, and Chang-Shyh Peng Abstract—Automated static analysis tools can perform as memory corruption, memory leaks and race conditions, efficient thorough checking of important properties of, and of software during execution. Since defects will not be extract and summarize critical information about, a source discovered until late in the software development program. This paper evaluates three open-source static lifecycle, dynamic analysis can be costly. On the other analysis tools; Flawfinder, Cppcheck and Yasca. Each tool hand, static analysis tools perform analysis on source is analyzed with regards to usability, IDE integration, performance, and accuracy. Special emphasis is placed on code or byte code modules. It does not require any the integration of these tools into the development instrumentation or development of test cases, and can be environment to enable analysis during all phases of utilized upon the availability of the code. Static analysis development as well as to enable extension of rules and other tools can go through all paths of the code and uncover improvements within the tools. It is shown that Flawfinder significantly more and wider range of defects, including be the easiest to modify and extend, Cppcheck be inviting to detect logic errors, dead code, security vulnerabilities, and novices, and Yasca be the most accurate and versatile. so on. Index Terms—static, code, analysis, automation. Static analysis techniques range widely. Simple style checkers identify poorly written code that may violate coding standards or consistency rules.
[Show full text]
Luís Filipe Silva De Oliveira Web Security Analysis an Approach to HTML5 Risks and Pitfalls
Universidade do Minho Escola de Engenharia Luís Filipe Silva de Oliveira Web Security Analysis An approach to HTML5 risks and pitfalls Outubro de 2013 Universidade do Minho Escola de Engenharia Luís Filipe Silva de Oliveira Web Security Analysis An approach to HTML5 risks and pitfalls Dissertação de Mestrado Mestrado em Engenharia Informática Trabalho realizado sob orientação de Professor António Nestor Ribeiro Outubro de 2013 I would like to thank my parents for all the support and for providing me the oportunity to be here. I thank all my closest friends, specially Beatriz Almeida for all the support. A special thanks for maincheck and to Joao Ribeiro, which gave me the theme, oportunity and help in every way possible. Finally, I would like to thank my tutor, for the patient and support, and for helping me through this final stage of my academic life. ii ABSTRACT Web applications have become increasingly important in the last years. As more and more applications deal with sensitive and confidential data, the quantity and negative impact of security vulnerabilities has grown as well. To understand this impact, this work presents a study over the most common and risky security vulnerabilities seen on web applications today. Also, with the emerging of the new HTML5 specification, an approach is made on how HTML5 will impact web security. The goal is to describe the new features of HTML5 and demonstrate how they may, or may not, introduce new security vulnerabilities to web applications. Understanding the vulnerabilities is only the first step, as that knowledge is worth- less if not applied into the software development life cycle.
[Show full text]
Developer Companion: a Framework to Produce Secure Web Applications
Developer Companion: A Framework to Produce Secure Web Applications Mamdouh Alenezi Yasir Javed College of Computer & Information Sciences College of Computer & Information Sciences Prince Sultan University Prince Sultan University Riyadh 11586, Saudi Arabia Riyadh 11586, Saudi Arabia [email protected] [email protected] Abstract—Software engineering and development is a very inspection or reviews), static Analysis, dynamic analysis, and complex endeavor that contends with limited resources, poten- security testing [8], [9]. tially causing software to behave in an unexpected manner. Software developers often lack secure coding skills and its a From 1988 to 2016 total vulnerabilities recorded by Na- major reason behind development of insecure web applications. In tional Vulnerability Database (NVD) are 72,855 out of which this work, we propose a developer companion as an integrated 6,488 are just reported in 2015. Probable security vulnerabili- framework that can be integrated to any IDE to educate and ties can be detected using static analysis tools. These tools also help developers produce more secure code. This framework provide details about each flaw like which line has flaw, type can be adopted and can be made more intelligent by focusing of flaw, what possible vulnerability can cause etc. Based on on historical security flaws in the development team. expert several studies, it was expected that 90 percent of security developers practices to overcome the security vulnerabilities. incidents are results of exploiting defects in the design or Keywords—web applications, source code, security, static anal- code of commonly used software [10]. The main purpose of ysis static analysis tools is to find coding errors before they can be exploited.
[Show full text]
Evaluation of Static Analysis Tools for Finding Vulnerabilities in Java and C/C++ Source Code
Evaluation of Static Analysis Tools for Finding Vulnerabilities in Java and C/C++ Source Code Rahma Mahmood, Qusay H. Mahmoud Department of Electrical, Computer & Software Engineering University of Ontario Institute of Technology Oshawa, ON, Canada {rahma.mahmood1,qusay.mahmoud}@uoit.net Keywords: static analysis tools; bugs; software security. Abstract The rest of this paper is organized as follows. Section 2 discusses It is quite common for security testing to be delayed until after the the related work. Java source code analyzers are evaluated in software has been developed, but vulnerabilities may get noticed Section 3, and C/C++ code analyzers are discussed in Section 4. throughout the implementation phase and the earlier they are discovered, the easier and cheaper it will be to fix them. Software Conclusions are presented in Section 5. development processes such as the secure software development lifecycle incorporates security at every stage of the design and 2 Related Work development process. Static code scanning tools find vulnerabilities in code by highlighting potential security flaws and offer examples on There have been many studies on static analysis tools focusing how to resolve them, and some may even modify the code to remove on their functionality or performance evaluation, such as those the susceptibility. This paper compares static analysis tools for Java covered in [1, 3, 5, 7, 13]. Many of the studies focus on and C/C++ source code, and explores their pros and cons. evaluation of a specific tool, for example in [7] the focus is on FindBugs. Other studies, such as previous work with the second 1 Introduction author [5] cover several tools where they also evaluated tools using the Common Weakness Enumeration (CWE), which is a Ensuring security from the early stages of software development list of software security vulnerabilities found throughout the will save time, money and ensure a secure application software development industry, and is a community-driven environment.
[Show full text]
Outil D'audit De Code Source
OUTIL D’AUDIT DE CODE Yasca Ce guide décrit l’installation et l’utilisation de l’outil d’audit de code source « yasca » sur un système windows XP/Vista/7. Yasca est un analyseur de code source qui intègre d’autres outils open- source (PMD, FindBugs, jlint) afin de générer un rapport. Agence National e de la Sécurité Informatique Gestion des versions du document Version Date Modification apportée 1.0 27 /08/2010 Première version Document Publique Document Interne 1 PLAN 1. Presentation ......................................................................................................................................................................... 3 2. Fonctionnement .................................................................................................................................................................. 4 3. Installation ........................................................................................................................................................................... 4 3.1.3.1.3.1. Prérequis ...................................................................................................................................................................... 4 3.2.3.2.3.2. Yasca .............................................................................................................................................................................. 4 3.3.3.3.3.3. Plugins .........................................................................................................................................................................
[Show full text]
Pentest + Pen-Test Tools
Pentest + Pen-test Tools Author: Joseph Lee Email: joseph@ ripplesoftware.ca Mobile: 778-725-3206 Tool Use Cases • Reconnaissance • Enumeration • Vulnerability scanning • Credential attacks • Persistence • Configuration compliance • Evasion • Decompilation • Forensics • Debugging • Software assurance Categories of Pentest Software Tools • Documentation • Reconnaissance • Scanners • OSINT • Remote Access • Credential Testing • Wireless • Networking • Debuggers • Web proxies • Mobile Tools • Software Assurance Testing • Social Engineering • Exploitation Frameworks Specific Tools By Category Documentation • XML documentation ◦ WSDL – Web Services Description Language ▪ RFC – https://www.w3.org/TR/2001/NOTE-wsdl-20010315 ▪ XML format for describing functionality of network services ▪ Contains either document-oriented or procedure-oriented information ▪ WSDL is extensible to work with any endpoint / protocol ◦ SOAP – Simple Object Access Protocol ▪ Info: https://www.w3schools.com/xml/xml_soap.asp ▪ SOAP APIs work over HTTP / HTTPS ▪ Documentation can describe the API ◦ XSD – XML Schema Definition Language ▪ W3C: https://www.w3.org/TR/xmlschema11-1/ ▪ Specifies how to formally describe the elements in an Extensible Markup Language (XML) document ▪ Can provide detailed information about how a specific XML syntax works • API – Application Programming Interface documentation ◦ Various API standards come with their own syntax ◦ Swagger ▪ https://swagger.io ▪ Open-source API tools ◦ Oracle Apiary ▪ https://apiary.io/ ▪ API Design Stack ◦ RAML ▪
[Show full text]