Astvuln is a simple AST scanner which recursively scans a directory, parses each file as AST and runs specified method.

Overview

Astvuln

Astvuln is a simple AST scanner which recursively scans a directory, parses each file as AST and runs specified method. Some search methods are provided with the tool and can be found under ./src/visitors/ in common.py and custom.py but most methods are not included in the repository. To add a new search method edit one of existing files and add a new class. The simplest way is to extend it from AstVisitor class. Implement query logic using generic_visit/visit_{class}.

This tool was developed for research purposes with the idea to explore potential vulnerable patterns when a new type of bug is discovered in our code. We can use such patterns to potentially find new similar bugs. AST code patterns which have sufficiently low false positive rate should then be included in SAST automation.

Usage

Astvuln: Search Python code for AST patterns.
Usage: 
   
     [-a 
    
     ][-h][-e 
     
      ][-g][-c][-n][-p 
      
       ][-s 
       
        ] Options: -a|--args 
        
          Arguments for method -h|--help Show help and exit -e|--extensions 
         
           Extensions to process -g|--grepable Make results easier to grep -c|--no-colors Don't print colors -n|--no-source Don't print source code -p|--path 
          
            Starting directory -s|--skip 
           
             Paths to skip Common methods: assign Find assignements with matching names (name) call Find all function calls with matching name (name, path) class Find all classes with matching name (name) constant Find all constants with matching value (name) dict Find all dicts with matching item constant value (name) dump Dump AST function Find all functions and methods with matching name (name) list Find all lists with matching constant value (name) name Find all matching names (name) print Print node names test Do nothing Custom methods: forelse Search for `for` loops with `else` clause which seems to always trigger replace_with_substring Search for replace of a string with a substring or an empty string unused_classes Find classes which are never directly referenced by name (ignore) Reading methods from file: Run method "file" and pass filename in method arguments to run multiple methods in a single run. Each method needs to be specified in a single line and colon-seperated from arguments. E. g. "./astvuln foo -a bar,baz" would be translated to: foo:bar,baz Examples: ./astvuln -h # Print help ./astvuln print -c # Run method `print` without color output ./astvuln dump -p dir # Run method `dump` on directory `dir` ./astvuln call -a bytes # Run method `call` with argument `bytes` ./astvuln foo -a a=1,b=2 # Run method `foo` with arguments a = 1 and b = 2 ./astvuln file -a methods.txt # Run multiple methods specified in a file 
           
          
         
        
       
      
     
    
   

License

Astvuln is released under the MIT License.

Owner
Bitstamp Security
Security team at Bitstamp cryptocurrency exchange
Bitstamp Security
A monitor than send discord webhook when a specific monitored product has stock in your nearby pickup stores.

Welcome to Apple In-store Monitor This is a monitor that are not fully scaled, and might still have some bugs.

5 Jun 16, 2022
a simple function that randomly generates and applies console text colors

ChangeConsoleTextColour a simple function that randomly generates and applies console text colors This repository corresponds to my Python Functions f

Mariya 6 Sep 20, 2022
VerSign: Easy Signature Verification in Python

VerSign: Easy Signature Verification in Python versign is a small Python package which can be used to perform verification of offline signatures. It a

Muhammad Saif Ullah Khan 3 Dec 01, 2022
This tool lets you perform some quick tasks for CTFs and Pentesting.

This tool lets you convert strings and numbers between number bases (2, 8, 10 and 16) as well as ASCII text. You can use the IP address analyzer to find out details on IPv4 and perform abbreviation a

Ayomide Ayodele-Soyebo 1 Jul 16, 2022
Playing with python imports and inducing those pesky errors.

super-duper-python-imports In this repository we are playing with python imports and inducing those pesky ImportErrors. File Organization project β”‚

James Kelsey 2 Oct 14, 2021
Random Number Generator

Application for generating a random number.

Michael J Bailey 1 Oct 12, 2021
A collection of custom scripts for working with Quake assets.

Custom Quake Tools A collection of custom scripts for working with Quake assets. Features Script to list all BSP files in a Quake mod

Jason Brownlee 3 Jul 05, 2022
Grank is a feature-rich script that automatically grinds Dank Memer for you

Grank Inspired by this repository. This is a WIP and there will be more functions added in the future. What is Grank? Grank is a feature-rich script t

42 Jul 20, 2022
The Black shade analyser and comparison tool.

diff-shades The Black shade analyser and comparison tool. AKA Richard's personal take at a better black-primer (by stealing ideas from mypy-primer) :p

Richard Si 10 Apr 29, 2022
Allows you to canibalize methods from classes effectively implementing trait-oriented programming

About This package enables code reuse in non-inheritance way from existing classes, effectively implementing traits-oriented programming pattern. Stor

1 Dec 13, 2021
Utility to add/remove licenses to/from source files

Utility to add/remove licenses to/from source files. Supports processing any combination of globs, files, and directories (recurse). Pruning options allow skipping non-licensing files.

Eduardo Ponce Mojica 2 Jan 29, 2022
Random Name and Slug Generator

Random Name and Slug Generator

Alexander Lukanin 104 Nov 30, 2022
Entropy-controlled contexts in Python

Python module ordered ordered module is the opposite to random - it maintains order in the program. import random x = 5 def increase(): global x

HyperC 36 Nov 03, 2022
A collection of common regular expressions bundled with an easy to use interface.

CommonRegex Find all times, dates, links, phone numbers, emails, ip addresses, prices, hex colors, and credit card numbers in a string. We did the har

Madison May 1.5k Dec 31, 2022
A random cats photos python module

A random cats photos python module

Fayas Noushad 6 Dec 01, 2021
Creates a C array from a hex-string or a stream of binary data.

hex2array-c Creates a C array from a hex-string. Usage Usage: python3 hex2array_c.py HEX_STRING [-h|--help] Use '-' to read the hex string from STDIN.

John Doe 3 Nov 24, 2022
Simple Python tool that generates a pseudo-random password with numbers, letters, and special characters in accordance with password policy best practices.

Simple Python tool that generates a pseudo-random password with numbers, letters, and special characters in accordance with password policy best practices.

Joe Helle 7 Mar 25, 2022
UUID version 7, which are time-sortable (following the Peabody RFC4122 draft)

uuid7 - time-sortable UUIDs This module implements the version 7 UUIDs, proposed by Peabody and Davis in https://www.ietf.org/id/draft-peabody-dispatc

Steve Simmons 22 Dec 20, 2022
ZX Spectrum Utilities: (zx-spectrum-utils)

Here are a few utility programs that can be used with the zx spectrum. The ZX Spectrum is one of the first home computers from the early 1980s.

Graham Oakes 4 Mar 07, 2022
πŸ’‰ μ½”λ‘œλ‚˜ μž”μ—¬λ°±μ‹  μ˜ˆμ•½ 맀크둜 μ»€μŠ€ν…€ λΉŒλ“œ (속도 ν–₯상 버전)

Korea-Covid-19-Vaccine-Reservation μ½”λ‘œλ‚˜ μž”μ—¬ λ°±μ‹  μ˜ˆμ•½ 맀크둜λ₯Ό 기반으둜 ν•œ μ»€μŠ€ν…€ λΉŒλ“œμž…λ‹ˆλ‹€. 더 λΉ λ₯Έ λ°±μ‹  μ˜ˆμ•½μ„ λͺ©ν‘œλ‘œ ν•˜λ©°, 속도λ₯Ό μš°μ„ ν•˜κΈ° λ•Œλ¬Έμ— μ‚¬μš©μžλŠ” 이에 λŒ€μ²˜κ°€ κ°€λŠ₯ν•΄μ•Ό ν•©λ‹ˆλ‹€. μ§€μ •ν•œ μ’Œν‘œ λ‚΄ λŒ€κΈ°μ€‘μΈ λ³‘μ›μ—μ„œ μž”μ—¬ λ°±μ‹ 

Queue.ri 21 Aug 15, 2022