raptor - Web-based Source Code Vulnerability Scanner

项目说明

!Raptor

Raptor is a web-based (web-serivce + UI) github centric source- scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans e you commit or merge a pull request. The scan is done asynchonously and the results are a only to the user who initiated the scan.

Some of the features of the Raptor:
- Plug-in architecture (plug and play external tools and generate unified reports)
- Web-service can be le for custom automation (without the need of the UI)
- Easy to create/edit/delete signatures for new and/or programming languages.

> This tool is an attempt to help the community and start-up companies to
> emphasize on secure-coding. This tool may or may not match the features/quality of commercial alternatives, nothing is guaranteed and you have been warned. This tool is targeted to be used by security code-re and/or de with secure-coding experience to find entry-points during code-audits or peer reviews. Please DO NOT trust the tool's output blindly.
> This is best-used if you plug Raptor into your CI/CD pipeline.

0.1 beta

Tech

Integrated Plugins:

Note: Most of the following tools/modules/libs have been modified heavily to be able to integrate well in the framework.

* :zap: Mozilla ScanJS - for Ja (Client-Side, Node.JS etc. and upcomming support for Chrome Extensions & Firefox Plugins)
* :zap: Brakeman - for Ruby On Rails
* :zap: RIPS - for PHP
* :zap: Manitree - for AndroidManifest.xml insecurities

A Rulepacks:
* :zap: ActionScript - supports Flash/Flex (ActionScript 2.0 & 3.0) source/sinks
* :zap: FindSecurityBugs (rules Only) - for Java (J2EE, JSP, Android, Scala, Groovy etc.)
* :zap: gitrob - for Sensitive Date Exposure (files containing credentials, configuration, backup, private settings etc.)

Installation (Tested on a Ubuntu 14.04 x64 LAMP instance)

Installation Video: YouTube Install

Usage

##### Scanner
Installation Video: YouTube Usage

Now point your browser to Raptor Home ()

###### Login
Login with the username as registered on the corresponding github server you are connected to and *any* password (but remember the username to view scan history)

For example:

If you are registered as foobar on then use the same username when scanning repos on However if are registered as foobar_corp on your personal/corporate github (say ) then use the same username if you intend to scan repos on

However, as of now password can be anything, since we have *NOT* implemented a database in the de .

##### Rules Editor
You can use the bundled light-weight, GUI client-side rules editor for adding any new/custom rule(s) for your specific requirements(s) or any other plain-text editor as the rulepack files are just simple JSON structures. Use your browser to open rules located in 'backend/rules'. When you are done, save your new/modified rules file in same directory i.e. 'backend/rules'. All you need to do now is a minor edit, here: Init Script. Append your new rulepack filename to this array without the '.rulepack' extension and restart the backend server. You are all set! :thumbsup:

You can access it here: Rules Editor ()

Adding Rules

#### ignore_list.rulepack
Add a filename or directory name pattern to exclude from getting scanned. This is useful to ignore any known files like etc. or say the entire directory. For example in the sample content below, jquery means *jquery* and is case-sensiti be careful. In the section, of the plugin is the name of the rulepack file without the ".rulepack" extension as a under the rules/ directory. The field is the ID of the issue mentioned in each rule of the rulepack files: Example #1, Example #2. The field value can be either or or . The field is the exact string to be matched in case the is or . In case the field is the should contain the raw RegEx pattern which needs to be Base64 encoded to avoid any JSON syntax escaping related issues. is a Regular Expression based matching, will match the at the beginning of the snippet and will match at the end of the snippet.

The way it works is when the scanner has finished scanning for issues, it will iterate through all the issues found and remo that match the patterns (based on the type of match) of each plugin mentioned in the file.

(sample contents below)

#### your_rule_name.rulepack
You may either create an entirely new rulepack and add it to the scanner or you may write your own scanner plugin and add it to the framework.
A sample rulepack file is a very simple JSON structure.

If you want more control or add more intelligence to your scanner rather than a simple RegExp search, you may write a quick scanner plugin like this one and integrate the script here and append the script name here. That's it. That's pretty straight forward for anyone with basic Python scripting skills.

##### Public/Private GitHub instance
You can use Raptor to scan your organization's private as well as public instances of GitHub by specifying the right ser at here and here.

Screenshots

#### Login
!Login

#### Github Scan
!Github Scan

#### Zip Scan
!Zip Scan

#### Scan Started
!Scan Started

#### Scan in progress
!Scan in progress

#### Report Statistics
!Report Statistics

#### Issue Details
!Login

#### Export Report
!Export Report

#### Scan History
!Scan History

#### Rules Editor
!Rules Editor

#### Ser
!Ser

De

Want to contribute? Great!
Get in touch with me if you have an idea or else feel free to fork and improve. :blush:

Contributors

- Anant Shri (Commits)

License
----

GNU GPL v2.0

Known Bugs (& Workarounds)
----

>Ubuntu Kylin Installation

Free Software, Hell Yeah!

项目信息

开发语言：JavaScript

Star 数：356

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Web-based Source Code Vulnerability Scanner展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。