SAST scanner will be used as follows
Create a SASTApp object and load files by calling LoadFiles method. If LoadFiles method return true, it creates required objects.
After LoadFiles method calling, by calling ScanAll method, it retrieves all vulnerbilies objects.
This Static code analysis support following vulnerabilities
- Hardcode Password
- Insecure Cookie Flag
- Open Redirect
- Empty TryBlock
- Empty CatchBlock
- Weak Password Configuration
- Weak Hashing Configuration
- Csrf
- Ldap Injection
- Insecure Random Generation
- Sql Injection
- XPath Injection
- XSS Injection
- XXE Injection
- Forms Authentication: Weak Cookie Protection
- Cleartext Machine Key
- Weak Symmetric Algorithm
- Weak Cipher Mode
You can test applciation by following command
dotnet run -Path
Parameter Path
should be valid path of folder or file.
You can run the scanners individually by calling Scan
method with paramater of Enums.ScannerType
or
all sccanners by calling ScanAll
method in SASTApp
class.
Before running the project, You have to resolve the package references
dotnet restore
on Library project
dotnet run -"FilePath"
on Console project