Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Fortify released RATS: http://code.google.com/p/rough-auditing-tool-for-security/. You can try it, however, I am not very pleased with both commercial and open-source tool results. Probably commercial tools shows a bit better results. The problem is that today a lot of obvious bugs becomes extinct due to several reasons. Yes, there is still buggy and crappy software (and will always be), and such tools will find those bugs, but not those tricky. Most of work you still have to do manually.

share|improve this answer
add comment

David Wheeler of FlawFinder has a great list of (30) OSS/FS & (14) Proprietary static analysis tools:

http://www.dwheeler.com/flawfinder/#othertools

share|improve this answer
add comment

No.

"Good" in this case is mostly contradictory to "tools for scanning source code". Especially the free ones - not knocking opensource here, most of the commercial ones suck too.

The best (commercial) tool I've seen (and I've researched this quite a bit) - was Checkmarx by a wide margin. (Disclosure - though I don't work for them, I have worked with them in the past).
Lower down on the list would be IBM / Ounce (now called IBM Rational Appscan Source code Edition, or something like that...).
Further down is the "2nd tier" commercial tools, such as Klockworcks and such... Much, much further down on my list is the incumbent, Fortify (now owned by HP).

Note that all those are commercial, and quite expensive at that.

Lower down on the list are the free / opensource tools - simply because these do simple text searching, pretty much what you could do with e.g. grep.
In this list - RATS, ITS4, FlawFinder, some others... but they are pretty equivalent, not much logic in them, no compiling, etc.

If you were looking outside C and C++ - its not much different, except for some OWASP tools, e.g. O2 for .NET, LAPSE for Java...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.