Pixy – New & Free Open-source XSS and SQL Injection Scanner for PHP Programs


Cross-site scripting (XSS) and SQL injection (SQLI) vulnerabilities are present in many modern web applications, and are reported continuously on pages such as BugTraq. In the past, finding such vulnerabilities usually involved manual source code audits.

Unfortunately, this manual vulnerability search is a very tiresome and error-prone task.

Pixy is a Java program that performs automatic scans of PHP source code, aimed at the detection of XSS and SQL injection vulnerabilities. Pixy takes a PHP program as input, and creates a report that lists possible vulnerable points in the program, together with additional information for understanding the vulnerability.

Features

  • detection of SQL injection and XSS vulnerabilities in PHP source code
  • automatic resolution of file inclusions
  • computation of dependence graphs that help you understand the causes of reported vulnerabilities
  • static analysis engine (flow-sensitive, interprocedural, context-sensitive)
  • platform-independent (written in Java)

You can download directly here:

Download Pixy 3.0.

Or read more here:

http://pixybox.seclab.tuwien.ac.at/

Posted in: Exploits/Vulnerabilities, Hacking Tools

,


Latest Posts:


zBang - Privileged Account Threat Detection Tool zBang – Privileged Account Threat Detection Tool
zBang is a risk assessment tool for Privileged Account Threat Detection on a scanned network, organizations & red teams can use it to identify attack vectors
Memhunter - Automated Memory Resident Malware Detection Memhunter – Automated Memory Resident Malware Detection
Memhunter is an Automated Memory Resident Malware Detection tool for the hunting of memory resident malware at scale, improving threat hunter analysis process.
Sandcastle - AWS S3 Bucket Enumeration Tool Sandcastle – AWS S3 Bucket Enumeration Tool
Sandcastle is an Amazon AWS S3 Bucket Enumeration Tool, formerly known as bucketCrawler. The script takes a target's name as the stem argument (e.g. shopify).
Astra - API Automated Security Testing For REST Astra – API Automated Security Testing For REST
Astra is a Python-based tool for API Automated Security Testing, REST API penetration testing is complex due to continuous changes in existing APIs.
Judas DNS - Nameserver DNS Poisoning Attack Tool Judas DNS – Nameserver DNS Poisoning Attack Tool
Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation.
dsniff Download - Tools for Network Auditing & Password Sniffing dsniff Download – Tools for Network Auditing & Password Sniffing
Dsniff download is a collection of tools for network auditing & penetration testing. Dsniff, filesnarf, mailsnarf, msgsnarf, URLsnarf, and WebSpy passively monitor a network


2 Responses to Pixy – New & Free Open-source XSS and SQL Injection Scanner for PHP Programs

  1. Sandeep Nain August 31, 2007 at 1:55 am #

    Nice to see a good open source static code analyzer as compare to other commercial products (such as offered by fortify).

    Platform independence and Graph generation features make this tool far better than other products.

    hats off to Pixy developers. kool tool

  2. TheRealDonQuixote August 31, 2007 at 5:08 am #

    Man this tool is sweet!! For several reasons:
    A. Its free
    2. Cross Platform performance roxxx!!
    D. Automation

    I know, I know, the script kiddies will probably wreak havoc with this. But hey, my philosophy is that peeps need to have the vulnerabilities brought out in the open before anyone can close them.