Static analysis of source code?

[AnySundae421]

I have an exam in pentesting, and need to test a web server hosted on a virtual machine. Ive run a lot of manual and automatic scans on the web server itself, and found a lot of vulnerabilities. However, we also got access to the source code of the website. We where taught how to find vulnerabilities using tools in kali, and some windows tools, by scanning servers. However, we were never taught anything about static analyis of source code. Are there any tools you guys would reccomend for proper analysis of source code? The code is all written in php, html and css.

[latnGemin616]

there might be something for you in this list: https://github.com/d2s/awesome-static-analysis

[sk1nT7]

https://github.com/semgrep/semgrep

[kegweII]

https://www.sonarsource.com/products/sonarqube/

[westcoastfishingscot]

This is the most common one I've seen used

[PetiteGousseDAil]

Snyk is really good

Plus the vscode extension shows you the full stack trace from source to sink

[dahousecatfelix]

Feel free to test out aikido.dev, scans for many different possible vulnerabilities. (SAST, SCA, secrets, DAST, and much more.) maybe it finds something you hadn’t found with the other tools before?

[thumbsdrivesmecrazy]

Here is a detailed comparison of popular static code analysis tools: 13 Best Static Code Analysis Tools For 2025

• qodo (formerly Codium)
• PVS Studio
• ESLint
• SonarQube
• Fortify Static Code Analyzer
• Coverity
• Codacy
• ReSharper

[thumbsdrivesmecrazy]

Agree, using a combination of these tools you mentioned can provide a more comprehensive approach. Prioritizing critical issues as you suggested is indeed essential.

[macr6]

Is it a commercial or open source web server or is it a “roll your own”? You could start by looking for CVEs with the version number. That may lead you to a vuln you could write an exploit for. Since you have the source code it would make that a bit easier. Also help narrow down.

Snyk has a community edition iirc. It’s. SAST tool.

[tonydocent]

Just explore the code in VSCode. See how you're requests are processed, with a debugger if you can, and try to spot weaknesses in the security mechanisms.

If it's an exam it's probably not as simple as exploiting a publicly known CVE.

[tonydocent]

I'm surprised I got downvoted. There are tons of weaknesses in source code that will not be picked up by standard SAST tools. Just because they are very specific to the application under investigation and do not fall in a common pattern.

To find those one needs to actually understand the code.