scodescanner - SCodeScanner stands for Source Code scanner where

项目说明

<img src="/media/mylogo2.png" width=400>

SCodeScanner

SCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical . The main objective for this scanner is to find the inside the source code before code gets published in Prod.

Website for newreleases, new announcements -

Features

1) Supported <a href=" PHP</a> Language<br>
2) Supported <a href=" Language<br>
3) Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).<br>
4) Gi in JSON format, which can easily be used to any other program.
5) Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.
6) Rules that can scan advance patterns

How to run?

Download the repository -<br>

Run pip3 install -r requirements.txt <br>

And run python3 scscanner.py --help <br>

Run with supported lang like python3 scscanner.py php --help

Why Should I use SCodeScanner?

SCodeScanner is a fully open source, command line-based Python tool for identifying in code. It is designed to be easy to use and provides a number of features that set it apart from other tools, including:

Fewer false positives: SCodeScanner includes flags that help to eliminate false positives and only report on that are confirmed to exist.

Custom semgrep rules: SCodeScanner works with semgrep but creates its own rules, which helps to avoid false positives and time-consuming scans.

Command line Python based tool: SCodeScanner is a command-line based Python tool that is easy to use for people of all technical backgrounds. While many open source tools for identifying are GUI-based, SCodeScanner's command-line interface makes it simple to run from the terminal

Fast scanning: SCodeScanner's rules are designed to check for multiple at once, which results in fewer files for the rules to process and a faster scanning process o.

- SCodesScanner supported JIRA, SLACK integrations which gives the on the results identified by sending the file to Slack groups or by making the jira Issue.

Ability to track user input : SCodeScanner can identify instances where user input are defined in one file but used insecurely in another file.

Easy-to-read JSON output: SCodeScanner provides results in a JSON format that is easy to read and can be used for further analysis.

Achie

SCodeScanner received 5 CVEs for finding in multiple CMS plugins.

* C
* C
* C
* C
* C

Flags/Switches

* --folder: The flag takes the folder where the actual code resides. This is a required flag.

* --file: If we want to scan a file, the flag is required.

* --check: This flag will run the false remo identifying the . This basically checks whether the user input is real or not. The flag also creates a new modified JSON file after removing all the false positives. But the note point is, the tool will keep both original and modified of files.

* --json: Responsible for making the json files as output

* -o: This flag will create a text file with the output findings. The purpose of this flag is to make a human readable file that is easy to read. The flag is optional.

* --jira: Responsible for sending output files to the JIRA instance. (Need to add configurations inside the config.json file.). The flag is optional.

* --slack: Responsible for sending output files to SLACK instances. (Need to add configurations inside config.json file). The flag is optional.

References/Tutorials

*
*
*
*
*
*
*

Special Thanks

*

Todolist

Some cool features are coming.

Feedback/Impor

I would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you ha.

Contact

<a href=" Agrawal</a><br>
<a href="

项目信息

开发语言：Python

Star 数：159

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕SCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。