6
votes

I've been looking for some time now and have come up short. The most promising I found was Spike PHP, which seems to no longer work. I'm looking to scan my code for potential risks of SQL Injection, XSS, etc. I've gone through most of my code manually, but with a few hundred thousand lines of code, I'm sure I missed things. If possible, are there any tools that can be downloaded and analyze code on my local machine rather than installing to the live server (this isn't a requirement if not)?

6
  • Take a look at skipfish from Google. It doesn't focus on PHP but it will attack your code.
    – Stewart Robinson
    Commented Mar 12, 2011 at 23:59
  • From what I was reading it would run on the server and could disrupt service, which isn't an option since this isn't something that is in development, it is on a live site.
    – James Simpson
    Commented Mar 13, 2011 at 0:09
  • Voted to close as duplicate. Really, there are a lot of similar items here: security.stackexchange.com/questions/10/…, security.stackexchange.com/questions/1088/…, security.stackexchange.com/questions/32/…
    – anonymous
    Commented Mar 13, 2011 at 10:03
  • I do think this is a duplicate, however as it has been migrated across I think leaving it open for a while but moving @Ams comment to an answer might help the original poster see the other questions.
    – Rory Alsop ♦
    Commented Mar 13, 2011 at 12:15
  • Sorry, I didn't realize one had been opened for security until this question got moved from Server Fault.
    – James Simpson
    Commented Mar 15, 2011 at 5:43

6 Answers 6

Reset to default
5
votes

There's a static code analysis tool for PHP called RIPS. I've not had the chance to use it as yet, but it sounds like it's in the right kind of area for what you're looking to do.

On the commercial tool side of things, Fortify SCA has support for PHP, as far as I know.

3
votes

Check out YASCA. From their own site: it's a "glorified grep script" plus an aggregator of other open-source tools". I've had some success with this discovering security issues is the past, although I'd have to agree with the previous post that the commerical alternatives I've tried really are a couple of moves ahead.

2
votes

AppScan Source, a commercial tool from IBM, also has support for PHP.

2
  • The original question asks for free tools.
    – D.W.
    Commented Mar 21, 2011 at 7:20
  • Since the general consensus had covered the free PHP analysis tools as not being great, and another commenter had mentioned commercial tools, I though I would throw it in for completeness. I'm happy to delete it, though.
    – Aaron
    Commented Mar 21, 2011 at 18:28
2
votes

Unfortunately, the free tools aren't that great; they're pretty limited, not so easy to use for a security novice, and/or have only limited coverage of potential security issues.

You could look at free web pentesting tools, e.g., Burp Suite. For more recommendations, see, e.g., the following questions on this site: security assessment, pen testing tools. However realize that they have limited coverage and will miss many vulnerabilities.

0
votes

The Spike PHP Security Audit Tool is another static analysis tool to scan for security problems in PHP code.

0
votes
  • Acunetix
  • Nikto
  • Nessus
  • Wapiti
  • QualysGuard WAS
  • w3af

These will scan and audit your server/website and return insecurities. They are very useful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .