项目说明
Dynamic Analysis Tools
> An ongoing & curated collection of awesome scanning software, libraries and frameworks, best guidelines and technical resources and most important dynamic application security testing (DAST)
What is Dynamic Analysis?
Dynamic analysis is the testing and e of an application during runtime.
!dast
The primary ad of dynamic analysis: It reveals subtle defects or whose cause is too complex to be discovered by static analysis. Dynamic analysis can play a role in security assurance, but its primary goal is finding and debugging errors.
!dynamic
Table of Contents
#### Programming Languages
<details>
<summary>Show languages</summary>
<!-- Please use HTML syntax here so that it works for Github and mkdocs -->
<ul>
<li><a href="#dotnet">.NET</a></li>
<li><a href="#c">C</a></li>
<li><a href="#cpp">C++</a></li>
<li><a href="#java">Java</a></li>
<li><a href="#ja">Ja</a></li>
<li><a href="#php">PHP</a></li>
<li><a href="#python">Python</a></li>
<li><a href="#ruby">Ruby</a></li>
<li><a href="#rust">Rust</a></li>
<li><a href="#sql">SQL</a></li>
<li><a href="#"> Basic</a></li>
</ul>
</details>
#### Multiple languages
#### Other
API - Binaries
- Bytecode/IR
- Containers
- Laravel
- Security/DAST
- Web
- WebAssembly
- XML
---
Programming Languages
<h2 id="dotnet">.NET</h2>
Microsoft IntelliTest — Generate a candidate suite of tests for your .NET code.Pex and Moles — Pex automatically generates test suites with high code co using automated white box analysis.<h2 id="c">C</h2>
CHAP — Analyzes un-instrumented ELF core files for leaks, memory growth, and corruption. It helps explain memory growth, can identify some forms of corruption, and supplements a debugger by giving the status of memory locations.KLEE — Symbolic machine built on top of the LL infrastructure.LDRA :copyright: — A tool suite including dynamic analysis and test to standards can ensure test co to 100% op-code, branch & decsion co.LL Sanitizers — <ul> <li><a href=" - A memory error detector for C/C++</li> <li><a href=" - A detector of uninitialized memory reads in C/C++ programs.</li> <li><a href=" - A data race detector for C/C++</li> </ul>tis-interpreter — An interpreter for finding subtle bugs in programs written in standard C. — An instrumentation framework for building dynamic analysis tools.<h2 id="cpp">C++</h2>
CHAP — Analyzes un-instrumented ELF core files for leaks, memory growth, and corruption. It helps explain memory growth, can identify some forms of corruption, and supplements a debugger by giving the status of memory locations.KLEE — Symbolic machine built on top of the LL infrastructure.LDRA :copyright: — A tool suite including dynamic analysis and test to standards can ensure test co to 100% op-code, branch & decsion co.LL Sanitizers — <ul> <li><a href=" - A memory error detector for C/C++</li> <li><a href=" - A detector of uninitialized memory reads in C/C++ programs.</li> <li><a href=" - A data race detector for C/C++</li> </ul>tis-interpreter — An interpreter for finding subtle bugs in programs written in standard C. — An instrumentation framework for building dynamic analysis tools.<h2 id="java">Java</h2>
Ja — An extensible software model checking framework for Ja programs.Parasoft Jtest :copyright: — Jtest is an automated Ja testing and static analysis product that is made by Parasoft. The product includes technology for Data-flow analysis Unit test-case generation and execution, static analysis, regression testing, code co, and runtime error detection.<h2 id="ja">Ja</h2>
Iroh.js — A dynamic code analysis tool for Ja. Iroh allows to record your code flow in realtime, intercept runtime informations and manipulate program behaviour on the fly.Jalangi2 — Jalangi2 is a popular framework for writing dynamic analyses for Ja.<h2 id="php">PHP</h2>
Enlightn — A static and dynamic analysis tool for Lara that provides recommendations to improve the performance, security and code reliability of Laravel apps. Contains 120 automated checks.<h2 id="python">Python</h2>
CrossHair — Symbolic execution engine for testing Python contracts.icontract — Design-by-contract library supporting beha subtypingThere is also a wider tooling around the icontract library such as a linter (pyicontract-lint) and a plug-in for Sphinx (sphinx-icontract).
Scalene — A high-performance, high-precision CPU and memory profiler for Pythontypo — Runtime Type Checking for Python 3.<h2 id="ruby">Ruby</h2>
suture — A Ruby gem that helps you refactor your legacy code by the result of some old behavior with a new .<h2 id="rust">Rust</h2>
loom — Concurrency permutation testing tool for Rust. It runs a test many times, permuting the possible concurrent executions of that test.MIRI — An interpreter for Rust's mid-le representation, which can detect certain classes of undefined behavior like out-of-bounds memory accesses and use-after-free.puffin — Instrumentation profiler for Rust.stuck — provides a for quickly identifying common bottlenecks in running, asynchronous, and concurrent applications.<h2 id="sql">SQL</h2>
WhiteHat Sentinel Dynamic :copyright: — Part of the WhiteHat Application Security Platform. Dynamic application security scanner that covers the OWASP Top 10.<h2 id=""> Basic</h2>
:copyright: — Profiler, Protector and Debugger for VB6. Profiler measures performance and test co. Protector implements robust error handling. Debugger helps monitor your executables.Multiple languages
Code Pulse — Code Pulse is a free real-time code co tool for penetration testing acti by OWASP and Code Dx (GitHub).Gcov — GNU source code co program. Code co tool and profiling tool which is part of the GCC. Supports C, C++, Fortran.Other
<h2 id="api">API</h2>
Smartbear :copyright: — Test automation and performance testing platform<h2 id="binary">Binaries</h2>
angr — Platform agnostic binary analysis framework from UCSB.BOLT — Binary Optimization and Layout Tool - A linux command-line utility used for optimizing performance of binaries with profile guided permutation of linking to impro efficiencyDr. Memory — Dr. Memory is a memory monitoring tool capable of identifying memory-related programming errors (Github).DynamoRIO — Is a runtime code manipulation system that supports code transformations on any part of a program, while it executes.ll — Profile guided hot/cold function splitting to impro efficiency. An alternative to BOLT by FacebookPin Tools — A dynamic binary instrumentation tool and a platform for creating analysis tools.TRITON — Dynamic Binary Analysis for x86 binaries.<h2 id="bytecode">Bytecode/IR</h2>
souper — optimize LLVM IR with SMT solvers<h2 id="container">Containers</h2>
cadvisor — Analyzes resource usage and performance characteristics of running containers.<h2 id="laravel">Laravel</h2>
Enlightn — A static and dynamic analysis tool for Lara that provides recommendations to improve the performance, security and code reliability of Laravel apps. Contains 120 automated checks.<h2 id="security">Security/DAST</h2>
AppScan Standard :copyright: — HCL's AppScan is a dynamic application security testing suite (pre by IBM).Enlightn — A static and dynamic analysis tool for Lara that provides recommendations to improve the performance, security and code reliability of Laravel apps. Contains 120 automated checks.WebScanner :copyright: — WebScanner is a DAST solution for comprehensi audits of active web applications.WhiteHat Sentinel Dynamic :copyright: — Part of the WhiteHat Application Security Platform. Dynamic application security scanner that covers the OWASP Top 10.Full OWASP / Scanners<h2 id="web">Web</h2>
Smartbear :copyright: — Test automation and performance testing platform<h2 id="webassembly">WebAssembly</h2>
Wasabi — Wasabi is a framework for writing dynamic analyses for WebAssembly, written in Ja.<h2 id="xml">XML</h2>
WhiteHat Sentinel Dynamic :copyright: — Part of the WhiteHat Application Security Platform. Dynamic application security scanner that covers the OWASP Top 10.^ back to top ^
License
MIT License & cc license
<a rel="license" href=" alt="Creati License" style="border-width:0" src=" /></a><br />This work is licensed under a <a rel="license" href=" Attribution 4.0 International License</a>.
To the extent possible under law, Paul has waived all copyright and related or neighboring rights to this work.
项目信息
开发语言：未知
Star 数：14
技术要点
该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An ongoing & curated collection of awesome vulnerability scanning software, libraries and frameworks, best guidelines and technical resources and most important dynamic application security testing (DAST)展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。