wireghoul / graudit

grep rough audit - source code auditing tool

graudit

graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being very flexible.

Installation

Installation can be done as a user or globally as root, simply run make with the userinstall or install argument. It is however recommended to use graudit directly by cloning the git repository as it includes additional database rules not included on the distribution files. This also enables you to get updates between releases. To do this run the following command:

git clone https://github.com/wireghoul/graudit

You can then add graudit to your path, using the appropriate values for your preferred shell:

echo 'PATH="$HOME/graudit:${PATH:+:${PATH}}"; export PATH;' >> ~/.bashrc

If graudit is not in your home directory you may wish to set the GRDIR environment variable to the signatures directory in your .bashrc file.

export GRDIR=/path/to/graudit/signatures

Usage

graudit supports several options and tries to follow good shell practices. For a list of the options you can run graudit -h or see below. The simplest way to use graudit is;

graudit [opts] /path/to/scan

OPTIONS
  -d <dbname> database to use or /path/to/file.db (uses default if not specified)
  -A scan unwanted and difficult (ALL) files
  -x exclude these files (comma separated list: -x *.js,*.sql)
  -i case in-sensitive scan
  -c <num> number of lines of context to display before and after a match, default is 1

  -B suppress banner
  -L vim friendly lines
  -b colour blind friendly template
  -z suppress colors
  -Z high contrast colors
  
  -l lists databases available
  -v prints version number
  -h prints this help screen

You can set default commandline options via the GRARGS environment variable. This may affect the use of graudit in scripts so it's only recommended to use the B,L,b,z and Z options for this purpose.

echo 'GRARGS="-b -L"; export GRARGS' >> ~/.bashrc

Databases

graudit uses extended regular expressions (POSIX) as it's signatures and comes with several databases ready for use. You can extend the existing databases or make your own if you require additional signatures.

Databases can be loaded from multiple locations, the order of precedence is as follows:

1. Custom location specified via the GRDIR environment variable
2. /usr/share/graudit/
3. $HOME/.graudit/
4. A relative signatures/ directory from the graudit location
5. A relative misc/ directory from the graudit location
6. $HOME/graudit/signatures/
7. Any file that is specified with a full path, i.e: /home/user/my.db
8. Rules can be read from stdin by supplying - or /dev/stdin as the database

A list of the database files in order of precedence is shown with the -l switch: graudit -l

The following databases are included:

• actionscript
• android
• asp
• c
• cobol
• default (used if -d argument is omitted)
• dotnet
• eiffel
• exec
• fruit
• go
• ios
• java
• js
• nim
• perl
• php
• python
• ruby
• scala
• secrets
• spsqli
• sql
• strings
• typescript
• xss

Tutorial

A tutorial/introduction video can be found at: https://youtu.be/b8Xbzer1n94

Contributing

If you would like to contribute to graudit, please fork the repository at https://github.com/wireghoul/graudit and use that. In particular language rules, additional scripts and documentation contributions are very welcome. If you like graudit then please say thanks and share it around.

If you wish to get in contact with me, shoot me a line on github or twitter: @wireghoul

Credits

• Wireghoul - http://www.justanotherhacker.com
• Various others - see Changelog

graudit's Issues

Can't start scan of a project folder

[Feature]: Semantic versioning

This repository doesn't use semantic versioning. It really should, as that would allow graudit to exist in package managers so it can be updated more easily.

For example: 3.5 would become 3.5.0

A couple of questions

Hi,

What is the expected result from a scan? the matched phrases and their location?
Is it possible to get a report of sorts or a vulnerability count?
What's in the default database? because as far as i've seen if i don't choose the right language defaults yields zero results
Are the regular expressions used in the tool borrowed from other tools or made from scratch?

grep Option Error

Just to let you know that the version of grep that I am using does not have --exclude-dir option in this version. Below is the output from running graudit.

-bash-3.2# ./graudit -d php /tmp/www.of-networks.co.uk
grep: unrecognized option `--exclude-dir=.svn'
Usage: grep [OPTION]... PATTERN [FILE]...
Try `grep --help' for more information.
-bash-3.2# grep --version
grep (GNU grep) 2.5.1

Copyright 1988, 1992-1999, 2000, 2001 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

-bash-3.2#

Having looked through the code you may want to consider using just the grep --exclude option and passing a regex of the svn cvs and git dirs. This should achieve the same thing.
So passing grep the following:

        --exclude="*\.svn" \
        --exclude="*\.cvs" \
        --exclude="*\.git" \

Have made the modification to graudit and tested it on my version and those option parameters are working, so I will fork the file and update this issue.

Scan specific filetypes only?

Hi,

thanks for the tool first!

Besides manual grepping I am using it currently to spot potential candidates for SQL injections in a LAMP stack.

What I miss is querying PHP files only, so basically the opposite of '-x' as it finds JS files and throws ugly remarks to stderr for binary files like pictures. Same would probably apply for other languages too.

Cheers, Dirk

Couldn't run the analysis!

Hello! I'm new to this, trying to understand the tool and how it works but alas! I couldn't run it over a single file!

Getting this error, and don't know how to resolve this!

Run Fails?

I am trying to run a scan on some files, but after I submit the command, it just instantly goes to accepting more input and does not display any errors or results from any scan that might've run, without any indication whatsoever what may have happened. Honestly, the "documentation" for this tool is pretty poor, so trying to find answers and help with this has not been easy.

Note: I have blackened several areas of the image for sensitivity purposes, but the important aspects such as location of DB and commands used are there. I am running this on Windows as that is my native OS from which I work on, and the path to the directory is done using "C:/Users/[user]/path/to/directory" as stated.

WordPress dictionary?

Hi, first of all thanks for the tool - it looks like it's a very nifty tool. Please excuse the newb question, I am trying to understand if I'm doing something wrong here.

I have a PHP test piece of code, just to see how graudit works. The code is going to be intended for a WordPress site, so I am running
graudit -d wordpress filename.php

Initially the tool outputs this

My understanding is that $_POST is highlighted red because there is no filtering/escaping applied to it.

So, because I am using the wordpress dictionary I add something like sanitize_text_field() to the input, like so

What I would expect the tool to do now is no longer detect that code snippet as vulnerable as it's been sanitized with a WP function, but it still reports it as such.

Am I getting the wrong end of the stick here?

Unable to build graudit

On mac High Sierra, trying to build graudit.

First tried make and it errored on the git test #1.

Commented out that test and it went forward. Sorry don't have time to give complete details but it seems like missing configure.ac might be the problem. How would I go about generating that / what is the correct build process for graudit?

PHP - Dynamic function dispatch

According to this gist of dangerous PHP functions, a dynamic function dispatch with user supplied input
e.g. $_GET['func']($_GET['arg']) leads to RCE vulnerabilities.
I'm unsure if there's a pattern for this currently, if there isn't, would the below regex pattern be suitable for inclusion in a PHP signature?

https://regex101.com/r/2r2eQ8/1

Windows style newline characters can cause issues in Cygwin.

When I did make install in cygwin I only got the error ./runtests.sh: line 3: $'\r': command not found

To fix it I used the command dos2unix graudit/*; make install.

Then it works perfectly.

So I suggest to include the command dos2unix in the make for cygwin or to directly avoid windows style newline characters.

unescaped backslash removes all occurrences of the letter 'r' in output

here:

graudit/graudit

Line 202 in db44ad2

| sed -e's/\r//g' -e"s/^\(\x1b\[.*m\x1b\[K\)--\(\x1b\[.*\x1b\[K\)$/\1##############################################\2/" -e"s/^--$/$separator/" | sed -e"$vimlines" -e"$zimlines"

at least when using ggrep on OSX

Finding better patterns for false positive avoiding.

I'm using Graudit with various source codes for testing purposes. I found problems with false positives but I'm not sure how should I improve the databases so I could fix some issues.

The following code is part of a52dec:

static inline ao_instance_t * ao_open (ao_open_t * open)
{
    return open ();
}

With the open\s*\( pattern, declaration of ao_open is detected as vulnerable when it clearly isn't. Furthermore the call to open inside this function is also not vulnerable but again it is a false positive.

For the first problem I think we should check for for an exact open instead for open preceded by anything. Particular cases such as something=open(... should be taken into account.

For the second a minimal check for the correct amount of parameters could work.

What do you think?

old signatures usage

hi @wireghoul,

Thanks for the nice tool. Can you please let know about the source of the signatures? The signatures in the master branch are years old, may be we should use updated signature if available.

Test fail in master

* FAIL 1: 1
    whitespace test test `../graudit -c 0 -d ../signatures/php.db whitespace.php | wc -l` -eq 2
*   ok 2: exec test
* failed 1 among 2 test(s)

Release tags

Please, it would be nice to tag the releases in the repository.

I'm currently working on Archlinux packaging because it is broken.

Default build target fails

Graudit 1.9 source downloaded from http://www.justanotherhacker.com/projects/graudit/download.html fails to compile when make is run.

$ make
rm -f graudit-*.tar.gz graudit-*.zip
rm -f t/test-results/*
rm -f graudit.1 graudit.7
cat signatures/dotnet/*.db > signatures/dotnet.db
cat signatures/php/*.db > signatures/php.db
cat signatures/perl/*.db > signatures/perl.db
cat signatures/python/*.db > signatures/python.db
cat signatures/asp.db > signatures/all.db
cat signatures/c.db >> signatures/all.db
cat signatures/dotnet.db >> signatures/all.db
cat signatures/default.db >> signatures/all.db
cat signatures/jsp.db >> signatures/all.db
cat signatures/other.db >> signatures/all.db
cat signatures/perl.db >> signatures/all.db
cat signatures/php.db >> signatures/all.db
cat signatures/python.db >> signatures/all.db
cat signatures/*/xss.db > signatures/xss.db
cat signatures/*/sql.db > signatures/sql.db
cat signatures/*/exec.db > signatures/exec.db
nroff -Tascii -mandoc <graudit.in.1 >/dev/null
/bin/sh: graudit.in.1: No such file or directory
Makefile:83: recipe for target 'manpages' failed
make: *** [manpages] Error 1

Matching filename via glob

graudit produces a LOT of matches. A lot of it are false positives in files I would not be interested in looking in.

It would be absolutely helpful to include / exclude files based on globbing.

For example:

graudit -I './src/service/**/*.js'
graudit -X '**/node_modules/**'

[Suggestion] various potentially new rules

Maybe some rules of use in here:

https://littlemaninmyhead.wordpress.com/2019/08/04/dont-underestimate-grep-based-code-scanning/

Rule list is at the end.

greap for "echo" v/s graudit; we can see graudit does not report all usage of echo

DC-C02TK34GGTDY:cr samirkumar.rakshit$ grep -i "echo" .
index.php:
index.php:

Hi ,

index.php:

index.php:
login.php:
register.php:
DC-C02TK34GGTDY:cr samirkumar.rakshit$
DC-C02TK34GGTDY:cr samirkumar.rakshit$
DC-C02TK34GGTDY:cr samirkumar.rakshit$
DC-C02TK34GGTDY:cr samirkumar.rakshit$ ../../graudit/graudit -A .

                                  .___ __  __   
      _________________  __ __  __| _/|__|/  |_ 
     / ___\_` __ \__  \ |  |  \/ __ | | \\_  __\
    / /_/  >  | \// __ \|  |  / /_/ | |  ||  |  
    \___  /|__|  (____  /____/\____ | |__||__|  
   /_____/            \/           \/           
          grep rough audit - static analysis tool
              v2.4 written by @Wireghoul

=================================[justanotherhacker.com]===
./index.php-33-

Upload (only PDF)

./index.php:34:
./index.php-35-
##############################################
##############################################
./classes/user.php-38- $sql.= """;
./classes/user.php:39: $result = mysql_query($sql);
./classes/user.php-40- if ($result) {
##############################################
##############################################
./classes/user.php-53- $sql.= "")";
./classes/user.php:54: $result = mysql_query($sql);
./classes/user.php-55- if ($result) {
##############################################
##############################################
./classes/user.php-71- $sql.= ""))";
./classes/user.php:72: $result = mysql_query($sql);
./classes/user.php-73- if ($result) {
Binary file ./.index.php.swp matches

trouble parsing graudit.7

Describe the bug
ECANTPARSEGRAUDIT.7

To Reproduce
Steps to reproduce the behavior:

1. Run man 7 graudit

Expected behavior
Show something more useful

Actual behavior
It says iblahblahblahblah blahblhablhablhablhablhab

Debugging
not applicable

Please complete the following information

• OS: Debian GNU/Linux sid+experimental
• 3.6
• https://ftp-master.debian.org/new/graudit_3.6-1.html

PHP mysqli::query

Hi,

I was struggling in a project to find OO queries which weren't safe. If I didn't overlook anything, graudit didn't help me much.
So I ended up using grep myself to identify statements like "$db_handle->query($unsafe)" (which wasn't easy as either there were too many false positives or negatives, depending on my quick choice of grep patterns).

Any chance for a pattern to catch this unsafe OO queries somehow ?

Cheers, Dirk

Scan files selectively based on file extensions.

It would be nice to have a folder scan method that would select databases based on the file extension.