Skip to content

source-code-analysis.md

Latest commit

 

History

History
208 lines (141 loc) · 7.72 KB

source-code-analysis.md

File metadata and controls

208 lines (141 loc) · 7.72 KB
Raw
title Source Code Analysis
type technique
tags
cloud
linux
recon
reference-import
sast
web
windows
phase recon
date_created 2026-05-13
date_updated 2026-07-02
sources
InternalAllTheThings

Source Code Analysis

What it is

Source code analysis is the process of examining and reviewing the code of a software program to identify errors, vulnerabilities, and potential improvements. This can be performed manually by developers or through automated tools that scan the code for issues like security risks, coding standard violations, and performance inefficiencies.

How it works

Source code analysis examines application code for security vulnerabilities by reviewing authentication logic, input validation, cryptographic usage, and data flow paths that handle untrusted input. Automated tools (SAST scanners like Semgrep, CodeQL, and Bandit) flag common vulnerability patterns, while manual review focuses on complex logic bugs, business logic flaws, and cryptographic implementation errors that automated tools miss. For penetration testing engagements with code access, reviewing entry points (API controllers, parsers, deserialization handlers) first identifies the highest-risk attack surface before moving to deeper logic review.

Attack phases

  • Exploitation: primary phase for this note (credential and control-plane abuse)
  • Adjacent phases: overlaps are common once credentials or lateral paths appear

Prerequisites

Authorized scope covering the depicted systems; valid credentials or network reach as required by each command block inside the methodology body.

Methodology

The following imported sections retain upstream ordering, tables, and copy-pasta blocks from InternalAllTheThings.

Source code analysis is the process of examining and reviewing the code of a software program to identify errors, vulnerabilities, and potential improvements. This can be performed manually by developers or through automated tools that scan the code for issues like security risks, coding standard violations, and performance inefficiencies.

AI Analysis

  • trailofbits/skills - Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows.
npm install -g @github/copilot
copilot
/login
/model
/plugin marketplace add trailofbits/skills
/plugin marketplace browse trailofbits
/plugin install ask-questions-if-underspecified@trailofbits
/plugin install static-analysis@trailofbits
/plugin install entry-point-analyzer@trailofbits
/plugin install semgrep-rule-creator@trailofbits
/plugin install semgrep-rule-variant-creator@trailofbits
/plugin install sharp-edges@trailofbits
/plugin install insecure-defaults@trailofbits

Semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Install:

docker run -it -v "${PWD}:/src" semgrep/semgrep semgrep login
docker run -e SEMGREP_APP_TOKEN=<TOKEN> --rm -v "${PWD}:/src" semgrep/semgrep semgrep ci

Semgrep rules:

Other Tools:

SonarQube

Continuous Inspection

Install

  • Docker
docker run -d --name sonarqube -p 9000:9000 sonarqube:community

Configuration

  • Go to localhost:9000
  • Login with admin:admin
  • Create a local project
  • Generate a token for the project
  • Use sonar-scanner-cli with the generated token
docker run --rm -e SONAR_HOST_URL="http://10.10.10.10:9000" -v "/tmp/www:/usr/src" sonarsource/sonar-scanner-cli -Dsonar.projectKey=sonar-project-name -Dsonar.sources=. -Dsonar.host.url=http://10.10.10.10:9000 -Dsonar.token=sqp_redacted
  • Check the Security Hotspots tab: http://10.10.10.10:9000/security_hotspots?id=sonar-project-name

⚠️ remove dead symbolic links before scanning a folder.

Psalm

A static analysis tool for finding errors in PHP applications

Install

composer require --dev vimeo/psalm

Configuration

  • Create a project and initiate a scan of the codebase
./vendor/bin/psalm --init
./vendor/bin/psalm --taint-analysis
./vendor/bin/psalm --report=results.sarif

CodeQL

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

Install:

Configuration

codeql resolve packs
codeql resolve languages
codeql database create <database> --language=<language-identifier>
codeql database create --language=python <output-folder>/python-database
codeql database create --language=cpp <output-folder>/cpp-database
codeql database analyze <database> --format=<format> --output=<output> <query-specifiers>...
codeql database analyze /codeql-dbs/example-repo javascript-code-scanning.qls --sarif-category=javascript-typescript  --format=sarif-latest --output=/temp/example-repo-js.sarif
codeql database analyze <database> microsoft/coding-standards@1.0.0 github/security-queries --format=sarifv2.1.0 --output=query-results.sarif --download

Snyk

Snyk CLI scans and monitors your projects for security vulnerabilities.

Install

curl https://static.snyk.io/cli/latest/snyk-linux -o snyk
chmod +x ./snyk
mv ./snyk /usr/local/bin/ 

docker run -it \
    -e "SNYK_TOKEN=<TOKEN>" \
    -v "<PROJECT_DIRECTORY>:/project" \
    -v "/home/user/.gradle:/home/node/.gradle" \
snyk/snyk:gradle:6.4 test --org=my-org-name

Configuration

snyk auth
snyk ignore --file-path=<directory_or_file>
snyk code test

# npm install snyk-to-html -g
snyk code test --json | snyk-to-html -o results-opensource.html

References

Bypasses and variants

Enumerate case-specific bypasses inside the methodologies above when upstream documented alternate paths.

Detection and defence

Apply vendor baselines for logging, least privilege, patch cadence, and segmentation. Map signals to SOC playbooks relevant to each platform referenced in this page.

Tools

  • [[codeql]]
  • [[semgrep]]

Sources