SpikeSource Spike PHP Security Audit Tool

Use Netsparker


Spike is an Open Source tool based on the popular RATS C based auditing tool implemented for PHP.

The tool Spike basically does static analysis of php code for security exploits, PHP5 and call-time pass-by-reference are currently required, but a PHP4 version is coming out this week.

This tool is especially welcomed by Darknet as there aren’t many static analysis tools out there that are free, and there are very few tools for auditing PHP code..which as we all known tends to be coded quite insecurely at times (just look at phpBB and PhpNUKE).


You can find the latest version here:

Spike PHP Audit Tool

Posted in: Countermeasures, Hacking Tools, Web Hacking

, , , , , , , ,


Latest Posts:


SCADA Hacking - Industrial Systems Woefully Insecure SCADA Hacking – Industrial Systems Woefully Insecure
airgeddon - Wireless Security Auditing Script airgeddon – Wireless Security Auditing Script
Airgeddon is a Bash powered multi-use Wireless Security Auditing Script for Linux systems with an extremely extensive feature list.
Acunetix v12 - Pause & Resume Acunetix v12 – More Comprehensive More Accurate & 2x Faster
Acunetix, the pioneer in automated web application security software, has announced the release of Acunetix v12 - more comprehensive, accurate & 2x faster.
CloudFrunt - Identify Misconfigured CloudFront Domains CloudFrunt – Identify Misconfigured CloudFront Domains
CloudFrunt is a Python-based tool for identifying misconfigured CloudFront domains, it uses DNS and looks for CNAMEs which may be allowed to be associated with CloudFront distributions.
Airbash - Fully Automated WPA PSK Handshake Capture Script Airbash – Fully Automated WPA PSK Handshake Capture Script
Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing, it is compatible with Bash and Android Shell.
XXEinjector - Automatic XXE Injection Tool For Exploitation XXEinjector – Automatic XXE Injection Tool For Exploitation
XXEinjector is an XXE Injection Tool that automates retrieving files using direct and out of band methods. Directory listing only works in Java applications.


3 Responses to SpikeSource Spike PHP Security Audit Tool

  1. Ezra Nugroho August 2, 2006 at 5:02 am #

    Thank you for the post, guys.

    BTW, the php 4 friendly version was released yesterday.

    http://ez.spikesource.com/phpsecaudit_023_released.htm
    http://developer.spikesource.com/projects/phpsecaudit

    Thanks,
    Ezra

  2. Darknet August 2, 2006 at 8:31 am #

    No worries, we are always happy to support new projects.

    Especially those which will lead to more secure coding practises for everyone!

  3. devloop August 2, 2006 at 11:19 pm #

    Very interesting project :)

    You should also try Wapiti for blackbox testing. It’s a “web application vulnerability scanner” released under the GPL License.