appshark

Document Index 1.overview 2.startup 3.how to write rules 4.how to find compliance problems use appshark 5.a path traversal game 6.argument 7.engine config 8.result 9.faq AppShark Appshark is a static taint analysis platform to scan vulnerabilities in an Android app. Prerequisites Appshark require...

mole

Mole Mole is a Binary Ninja plugin designed to identify interesting execution paths in binaries. It performs backward slicing on variables using Binary Ninja 's Medium Level Intermediate Language MLIL in Static Single Assignment SSA form, forming the basis for a static taint analysis. In Mole , a...

Ponce

Ponce Ponce pronounced 'poN θe pon-they is an IDA Pro plugin that provides users the ability to perform taint analysis and symbolic execution over binaries in an easy and intuitive fashion. With Ponce you are one click away from getting all the power from cutting edge symbolic execution. Entirely...

ioctlance

IOCTLance Description Presented at CODE BLUE 2023, this project titled Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis introduces IOCTLance, a tool that enhances its capacity to detect various vulnerability types in Windows Driver Model WDM drivers. In a...

testing-handbook

Trail of Bits Testing Handbook The Trail of Bits Testing Handbook is a resource for developers and security professionals on configuring, optimizing, and automating many static and dynamic analysis tools we use at Trail of Bits. Preview Testing Handbook: https://appsec.guide 🌐 Why is this needed?...

matt.net

Matt.Net Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Matt Lewis, matt dot lewis at nccgroup dot com http://www.github.com/nccgroup/matt.net Released under the AGPL. See LICENSE for more information. Overview Matt.Net is a simple GUI wrapper around Microsoft's...

CVE-2021-44228

Tai-e for CVE-2021-44228 This a sample project that utilizes Tai-e to identify Log4Shell a.k.a. CVE-2021-44228 vulnerability and its trigger paths Related video in Chinese: https://www.bilibili.com/video/BV1dV411F781 Getting started Clone this repository via Git: root@kitploit: git clone...

BootStomp

BootStomp BootStomp is a boot-loader bug finder. It looks for two different class of bugs: memory corruption and state storage vulnerabilities. For more info please refer to the BootStomp paper at https://seclab.cs.ucsb.edu/academic/publishing/bootstomp-security-bootloaders-mobile-devices-2017 To...

lava

LAVA: Large Scale Automated Vulnerability Addition Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into...

Triton

Triton is a dynamic binary analysis library. It provides internal components that allow you to build your program analysis tools, automate reverse engineering, perform software verification or just emulate code. Dynamic symbolic execution Dynamic taint analysis AST representation of the x86 ,...

opentaint

AI 時代のオープンソーステイント解析エンジン アプリケーションセキュリティのための形式的なテイント解析——AST パターンマッチングエンジンが見逃すものを発見し、LLM エージェントが脆弱性をルールとして適用できるようにし、どちらも単独では対応できない規模に拡張します。 English | 简体中文 | 繁體中文 | 한국어 | | | | | | | | | | | | | | | | | | | | |...

bincat

Introduction What is BinCAT? BinCAT is a static Binary Code Analysis Toolkit, designed to help reverse engineers, directly from IDA or using Python for automation. It features: value analysis registers and memory taint analysis type reconstruction and propagation backward and forward analysis...

bincat

简介 什么是 BinCAT？ BinCAT 是一个 静态 二进制代码分析工具包，旨在帮助逆向工程师，可直接在 IDA 中使用或通过 Python 实现自动化。 其功能包括： 值分析（寄存器和内存） 污点分析 类型重建与传播 反向分析与前向分析 释放后使用与双重释放检测 实际演示 您可以在此查看（旧版）BinCAT 的实际运行效果： 基础分析 使用数据污点分析 请查阅教程了解对应的操作任务。 常见问题快速解答 支持的主机平台： IDA 插件：全部，版本 7.4 或更高 （仅支持 Python 3） 分析器（本地或远程）：Linux、Windows、macOS（可能支持） 目前支持分析的...

maat

About Maat is an open-source Dynamic Symbolic Execution and Binary Analysis framework. It provides various functionalities such as symbolic execution, taint analysis, constraint solving, binary loading, environment simulation, and leverages Ghidra's sleigh library for assembly lifting:...

appshark

ドキュメントインデックス 1.概要 2.起動 3.ルールの書き方 4.AppSharkを使ったコンプライアンス問題の発見方法 5.パストラバーサルゲーム 6.引数 7.エンジン設定 8.結果 9.よくある質問 AppShark AppSharkは、Androidアプリの脆弱性をスキャンする静的テイント解析プラットフォームです。 前提条件 AppSharkには特定のバージョンのJDKが必要です。 -- JDK 11。テストの結果、依存関係の互換性の問題により、他のLTSバージョン（JDK 8およびJDK 16）では動作しません。 AppSharkのビルド/コンパイル...

smalien

Smalien Smalien is an information flow analysis and information leakage detection tool for Android application analysts. Smalien performs static taint analysis of Android applications on a Linux machine as well as dynamic taint analysis, detection of information leakage due to implicit informatio...

pyt

.. image:: https://travis-ci.org/python-security/pyt.svg?branch=master :target: https://travis-ci.org/python-security/pyt .. image:: https://readthedocs.org/projects/pyt/badge/?version=latest :target: http://pyt.readthedocs.io/en/latest/?badge=latest .. image::...

gosec

gosec - Go セキュリティチェッカー Go AST および SSA コード表現をスキャンすることで、ソースコードのセキュリティ問題を検査します。 クイックリンク GitHub Action ローカルインストール クイックスタート 一般的な使用パターン ルールの選択 出力フォーマット 特徴 パターンベースのルール — Go コードにおける一般的なセキュリティ問題を検出 SSA ベースのアナライザー — 型変換、スライス境界、暗号問題に対応 汚染解析 —...

ioctlance

IOCTLance 説明 CODE BLUE 2023で発表された、このプロジェクト「Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis」はIOCTLanceを紹介します。このツールは、Windows Driver Model...

Argus

Argus This repo contains the code for our USENIX Security '23 paper "ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions". Argus is a comprehensive security analysis tool specifically designed for GitHub Actions. Built with an aim to enhance the security of CI/CD...