flawfinder

About This is "flawfinder" by David A. Wheeler. Flawfinder is a simple program that scans C/C++ source code and reports potential security flaws. It can be a useful tool for examining software for vulnerabilities, and it can also serve as a simple introduction to static source code analysis tools...

action-octoscan

📦 :octocat: action octoscan A GitHub Action that performs a security scan of your GitHub actions. This action is based on octoscan 🤸 Usage Customizing inputs outputs Permissions 🤸 Usage Here is a basic example of how to use this action. This will work for both push and pullrequest events. --- nam...

graudit

graudit graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being...

WSSAT

WSSAT - Web Service Security Assessment Tool WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it...

JSAnalyzer

JS Analyzer - Burp Suite Extension by Jensec https://x.com/jensec A powerful Burp Suite extension for JavaScript static analysis. Extracts API endpoints, URLs, secrets, and email addresses from JavaScript files with intelligent noise filtering. The goal is reduce noise as much as possible to ensu...

magika

Magika Magika is a novel AI-powered file type detection tool that relies on the recent advance of deep learning to provide accurate detection. Under the hood, Magika employs a custom, highly optimized model that only weighs about a few MBs, and enables precise file identification within...

retdec

Warning The RetDec project is currently in a limited maintenance mode due to a lack of resources: Pull Requests are welcomed. They are reviewed with priority, if possible without delays. Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a...

APKDeepLens

APKDeepLens Android security insights in full spectrum. Features • Detection • Installation • Usage • Reports Featured atBlack Hat MEA 2023 and Black Hat ASIA 2024 What is APKDeepLens? APKDeepLens is a Python-based static analysis tool for Android APK files. It decompiles APKs using JADX and runs...

gixy

GIXY Overview Gixy is a tool to analyze Nginx configuration. The main goal of Gixy is to prevent security misconfiguration and automate flaw detection. Currently supported Python versions are 2.7, 3.5, 3.6 and 3.7. Disclaimer: Gixy is well tested only on GNU/Linux, other OSs may have some issues...

appshark

Document Index 1.overview 2.startup 3.how to write rules 4.how to find compliance problems use appshark 5.a path traversal game 6.argument 7.engine config 8.result 9.faq AppShark Appshark is a static taint analysis platform to scan vulnerabilities in an Android app. Prerequisites Appshark require...

Argus-SAF

Argus-SAF: Argus static analysis framework This is official reporitory for the Argus-SAF. For test and play with Argus-SAF, you can fork from our Argus-SAF-playground project, which have the basic setup for a Argus-SAF enhanced project with demo codes of how to perform different kind of analysis...

semgrep-rules

semgrep-rules Welcome! This repository contains Semgrep's Community Edition rules. In addition to the rules in this repository, the Semgrep Registry offers proprietary Pro rules that offer additional language coverage, and unlock crossfile and deep dataflow analysis. Find rules: search for...

xortool

xortool.py A tool to do some xor analysis: guess the key length based on count of equal chars guess the key base on knowledge of most frequent char Notice: xortool is now only running on Python 3. The old Python 2 version is accessible at the py2 branch. The pip package has been updated...

dexcalibur

WiP : Moving to dexcalibur 2.0 | codename : Reversense Dexcalibur Dexcalibur is an Android reverse engineering platform focus on instrumentation automation. Its particularity is to use dynamic analysis to improve static analysis heuristics. It aims automate boring tasks related to dynamic...

die-in-browser

die-in-browser Static binary analysis with Detect It Easy — 100% in your browser, no uploads. 🔍 What is this? This project runs Detect It Easy DIE — a powerful static binary analyzer — entirely inside your browser using the v86 emulator. ✅ No file uploads : binaries are processed locally. ✅ Full...

CVE-2025-59059-Misattributed-RCE-in-Apache-Ranger-Static-Analysis-Correction

CVE-2025-59059: Misattributed RCE in Apache Ranger a correction CVE: CVE-2025-59059 Affected versions: Apache Ranger "Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions = 2.7.0." this is wrong, or at least misleading. NashornScriptEngineCreator...

kube-linter

Static analysis for Kubernetes What is KubeLinter? KubeLinter analyzes Kubernetes YAML files, Helm charts, and Kustomize manifests, and checks them against a variety of best practices, with a focus on production readiness and security. KubeLinter runs sensible default checks, designed to give you...

infer

Infer Infer is a static analysis tool for Java, C++, Objective-C, and C. Infer is written in OCaml. Installation Read our Getting Started page for details on how to install packaged versions of Infer. To build Infer from source, see INSTALL.md. Contributing See CONTRIBUTING.md. License Infer is...

njsscan

njsscan njsscan is a static application testing SAST tool that can find insecure code patterns in your node.js applications using simple pattern matcher from libsast and syntax-aware semantic code pattern search tool semgrep. Made with in India Support njsscan Donate via Paypal: Sponsor the...

efiXplorer

efiXplorer - IDA plugin and loader for UEFI firmware analysis and reverse engineering automation Documentation Plugin wiki Loader wiki Build instructions and installation Publications efiXplorer: Hunting for UEFI Firmware Vulnerabilities at Scale with Automated Static Analysis Static...