67 matches found
vulnhawk
AI-powered code security scanner that finds vulnerabilities Semgrep and CodeQL miss. Quick Start • GitHub Action • Comparison • Languages • FAQ The Problem Traditional SAST tools rely on pattern matching and AST rules. They excel at catching known vulnerability patterns, but they fundamentally...
mobsfscan
mobsfscan mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Android XML, iOS Info.plist, Swift and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher...
sast-rules
Semgrep rules This is the central Semgrep rule repository that hosts the Semgrep rules for the GitLab semgrep analyzer. The repository is structured as follows: root@kitploit: . ├── mappings │ ├── findsecbugs.yml │ ├── eslint.yml │ └── ... ├── rules │ ├── lpgl │ │ ├── java │ │ │ ├── webview │ │...
semgrep-rules
semgrep-rules 欢迎！此仓库包含 Semgrep 的 社区版规则。 除了此仓库中的规则，Semgrep Registry 还提供专有的 Pro 规则，提供额外的语言覆盖，并解锁跨文件和深度数据流分析。 查找规则：通过 Semgrep Registry 搜索 搜索社区版和 Pro 规则。 使用规则：通过 Semgrep AppSec Platform 使用这些规则扫描你的代码。 贡献规则：参见 为 Semgrep 规则做贡献 了解更多信息。 使用 Semgrep 规则仓库 要开始编写和使用 Semgrep 规则，请参阅 学习 Semgrep 语法 和 编写规则。然后，使用...
vibegate
A security checkpoint for AI coding tools. It looks at every file an AI assistant writes, and stops the dangerous ones before they hit disk. What problem does this solve? AI coding assistants Claude Code, Codex, … write code fast — including code that handles things like passwords, emails, API...
njsscan
njsscan njsscan is a static application testing SAST tool that can find insecure code patterns in your node.js applications using simple pattern matcher from libsast and syntax-aware semantic code pattern search tool semgrep. Made with in India...
semgrep
Code scanning at ludicrous speed...
salus
Salus: Guardian of Code Safety and Security 🔍 Overview Salus Security Automation as a Lightweight Universal Scanner, named after the Roman goddess of protection, is a tool for coordinating the execution of security scanners. You can run Salus on a repository via the Docker daemon and it will...
Callisto
Callisto An Intelligent Automated Binary Vulnerability Analysis Tool Demo: Callisto is an intelligent automated binary vulnerability analysis tool. Its purpose is to autonomously decompile a provided binary and iterate through the psuedo code output looking for potential security vulnerabilities ...
semgrep-rules
semgrep-rules “攻击面就是漏洞。在那里找到漏洞只是一个细节。” —— Mark Dowd “有些细节比其他细节更重要。” —— Fedor G. Pikus 我的 Semgrep 规则集，用于促进漏洞研究。 博客文章 https://hnsecurity.it/blog/semgrep-ruleset-for-c-c-vulnerability-research https://hnsecurity.it/blog/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep...
semgrep-rules
elttam 的 semgrep-rules 欢迎来到 elttam 的公开 semgrep 规则仓库。 !semgrep ruleshttp...
semgrep-rules
Trail of Bits 公开 Semgrep 规则 此仓库包含由 Trail of Bits 开发并向公众提供的 Semgrep 规则。它们是我们持续开发工作的一部分，并用于我们的安全审计、漏洞研究和内部项目。随着我们发现新技术，它们将不断演变。 如需 Semgrep 指导，请访问 Testing Handbook。 使用 Semgrep 运行这些规则最简单的方式是从 Semgrep 注册表 运行它们。为此，请导航到项目的根目录并运行以下命令：shell $ semgrep --config "p/trailofbits" root@kitploit:...
nodejsscan
nodejsscan Node.js アプリケーション向けの静的セキュリティコードスキャナー SAST です。libsast と semgrep をベースにしています。 Made with in India...
nodejsscan
nodejsscan Static security code scanner SAST for Node.js applications powered by libsast and semgrep. Made with in India...
duo-agentflow-auditor
Duo AgentFlow Auditor AI Code Security — catching what SAST misses in AI-generated code Built on the GitLab Duo Agent Platform...
SAFE
SAFE SAFE 对研究工件中的 Semgrep 和 Trivy 发现执行受控的、仓库感知的安全评估。 它支持两个独立的分类任务：直接的 binary 预测（SECURITYRELEVANT 或 NONSECURITY）以及详细的 multiclass 上下文分类法（三个标签 — 参见 三个标签）。每个任务都可以在零样本或代理模式下运行。 它仅需要： 1. 一个以分号分隔的发现 CSV 文件。 2. 一个目录，其中每个 artifactid 对应一个研究工件文件夹。 3. 可选地，一个按 artifactid 键控的论文 PDF/文本集合。 4. 一个 OpenAI API 密钥或对组...
auth-header-trust-rules
auth-header-trust-rules A small Semgrep rule pack that flags code making authentication, authorization, or trust decisions based on HTTP request headers an attacker controls. The canonical example of the vulnerability class is CVE-2025-29927: Next.js trusted the x-middleware-subrequest header to...
springshell-rce-poc
CVE-2022-22965 - aplicación vulnerable y PoC Prueba y error root@kitploit: $ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py Ejemplo de salida root@kitploit: rce...
