{"id":2065,"date":"2009-09-16T09:46:04","date_gmt":"2009-09-16T09:46:04","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=2065"},"modified":"2017-09-09T21:03:49","modified_gmt":"2017-09-09T13:03:49","slug":"flawfinder-source-code-auditing-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2009\/09\/flawfinder-source-code-auditing-tool\/","title":{"rendered":"Flawfinder &#8211; Source Code Auditing Tool"},"content":{"rendered":"<p>Flawfinder is a source code auditing tool that reports possible security weaknesses (flaws) sorted by risk level. It&#8217;s very useful for quickly finding and removing at least some potential security problems before a program is widely released to the public. It&#8217;s a static analysis <a href=\"https:\/\/www.darknet.org.uk\/tag\/source-code-auditing\/\">source code auditing<\/a> tool.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2009\/09\/Flawfinder-Source-Code-Auditing-Tool-640x473.png\" alt=\"Flawfinder - Source Code Auditing Tool\" width=\"640\" height=\"473\" class=\"aligncenter size-medium wp-image-4720\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2009\/09\/Flawfinder-Source-Code-Auditing-Tool-640x473.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2009\/09\/Flawfinder-Source-Code-Auditing-Tool.png 996w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<h2>Using Flawfinder Source Code Auditing Tool<\/h2>\n<p>It is specifically designed to be easy to install and use. After installing it, at a command line just type:<\/p>\n<pre>flawfinder directory_with_source_code<\/pre>\n<p>Also it works on Unix-like systems today (it&#8217;s been tested on GNU\/Linux), and it should be easy to port to Windows systems. It requires Python 1.5 or greater to run (Python 1.3 or earlier won&#8217;t work).<\/p>\n<h3>Flawfinder Speed<\/h3>\n<p>Flawfinder is written in Python, to simplify the task of writing and extending it. Python code is not as fast as C code, but for the task I believe it&#8217;s just fine. The earlier version 0.12 on a 400Mhz Pentium II system analyzed 51055 lines in 39.7 seconds, resulting in an average of 1285 analyzed lines\/second. Flawfinder 1.20 and later will report their speed (in analyzed lines\/second) if you&#8217;re curious. <\/p>\n<h2>How Flawfinder works<\/h2>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>Flawfinder works by using a built-in database of C\/C++ functions with well-known problems, such as buffer overflow risks (e.g., strcpy(), strcat(), gets(), sprintf(), and the scanf() family), format string problems ([v][f]printf(), [v]snprintf(), and syslog()), race conditions (such as access(), chown(), chgrp(), chmod(), tmpfile(), tmpnam(), tempnam(), and mktemp()), potential shell metacharacter dangers (most of the exec() family, system(), popen()), and poor random number acquisition (such as random()). The good thing is that you don&#8217;t have to create this database &#8211; it comes with the tool.<\/p>\n<p>It then takes the source code text, and matches the source code text against those names, while ignoring text inside comments and strings (except for directives). It also knows about gettext (a common library for internationalized programs), and will treat constant strings passed through gettext as though they were constant strings; this reduces the number of false hits in internationalized programs. <\/p>\n<p>You can download Flawfinder here:<\/p>\n<p><a href=\"https:\/\/sourceforge.net\/projects\/flawfinder\/files\/flawfinder-2.0.4.tar.gz\/download\">flawfinder-2.0.4.tar.gz<\/a><\/p>\n<p>Or read more <a href=\"http:\/\/www.dwheeler.com\/flawfinder\/\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Flawfinder is a source code auditing tool that reports possible security weaknesses (flaws) sorted by risk level. It&#8217;s very useful for quickly finding and removing at least some potential security problems before a program is widely released to the public. It&#8217;s a static analysis source code auditing tool. Using Flawfinder Source Code Auditing Tool It [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"Flawfinder is a source code auditing tool written in Python that reports possible security weaknesses (flaws) sorted by risk level.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[29,11],"tags":[4334,284,2745,4391,4338],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/2065"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=2065"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/2065\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=2065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=2065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=2065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}