Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite
7

I've been looking for some time now and have come up short. The most promising I found was Spike PHP, which seems to no longer work. I'm looking to scan my code for potential risks of SQL Injection, XSS, etc. I've gone through most of my code manually, but with a few hundred thousand lines of code, I'm sure I missed things. If possible, are there any tools that can be downloaded and analyze code on my local machine rather than installing to the live server (this isn't a requirement if not)?

share
Take a look at skipfish from Google. It doesn't focus on PHP but it will attack your code. – Stewart Robinson Mar 12 '11 at 23:59
From what I was reading it would run on the server and could disrupt service, which isn't an option since this isn't something that is in development, it is on a live site. – James Simpson Mar 13 '11 at 0:09
Voted to close as duplicate. Really, there are a lot of similar items here: security.stackexchange.com/questions/10/…, security.stackexchange.com/questions/1088/…, security.stackexchange.com/questions/32/… – anonymous Mar 13 '11 at 10:03
I do think this is a duplicate, however as it has been migrated across I think leaving it open for a while but moving @Ams comment to an answer might help the original poster see the other questions. – Rory Alsop♦ Mar 13 '11 at 12:15
Sorry, I didn't realize one had been opened for security until this question got moved from Server Fault. – James Simpson Mar 15 '11 at 5:43
show 1 more comment

migrated from serverfault.com Mar 13 '11 at 2:34

locked by AviD♦ Oct 18 '12 at 16:50

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: FAQ.

6 Answers

up vote 0 down vote
  • Acunetix
  • Nikto
  • Nessus
  • Wapiti
  • QualysGuard WAS
  • w3af

These will scan and audit your server/website and return insecurities. They are very useful.

share
up vote 0 down vote

The Spike PHP Security Audit Tool is another static analysis tool to scan for security problems in PHP code.

share
up vote 2 down vote

Unfortunately, the free tools aren't that great; they're pretty limited, not so easy to use for a security novice, and/or have only limited coverage of potential security issues.

You could look at free web pentesting tools, e.g., Burp Suite. For more recommendations, see, e.g., the following questions on this site: security assessment, pen testing tools. However realize that they have limited coverage and will miss many vulnerabilities.

share
up vote 2 down vote

AppScan Source, a commercial tool from IBM, also has support for PHP.

share
The original question asks for free tools. – D.W. Mar 21 '11 at 7:20
Since the general consensus had covered the free PHP analysis tools as not being great, and another commenter had mentioned commercial tools, I though I would throw it in for completeness. I'm happy to delete it, though. – Aaron Mar 21 '11 at 18:28
up vote 3 down vote

Check out YASCA. From their own site: it's a "glorified grep script" plus an aggregator of other open-source tools". I've had some success with this discovering security issues is the past, although I'd have to agree with the previous post that the commerical alternatives I've tried really are a couple of moves ahead.

share
up vote 5 down vote

There's a static code analysis tool for PHP called RIPS. I've not had the chance to use it as yet, but it sounds like it's in the right kind of area for what you're looking to do.

On the commercial tool side of things, Fortify SCA has support for PHP, as far as I know.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.