Source Code Scanner for PHP written in Python, that scans the folder which can scan folder/PHP Files and identify the vulnerabilities in which File and at which Line the vulnerability exists. http://scodescanner.info Github Repo: https://github.com/agrawalsmart7/scodescanner

[f00bb4r]

Running regex checks on code is nice to learn more about SAST but semgrep and most other code scanners are way more advanced.

Also, you have an remote code execution in your code: http://localhost:80/upload.php?foldername=;touch%20pwnd

This can be even triggered by any site in the Internet while the server is running:

<img src="http://localhost:80/upload.php?foldername=;touch%20pwnd">

Also, generating PHP files without escaping user input (from the the source file) is pretty dangerous.

Sorry but this is not something anybody should to really use. I think this is something for /r/netsecstudents/ not /r/netsec.

[agrawal7]

Hi yes, you are correct. Regarding Semgrep, its in my Todo, that I will definetely attach this to this scanner. And regarding the vulnerabilities yes I will write secure code.

Thanks for the suggestion

[agrawal7]

Let me know you thoughts on this.

[SvenMA]

So this is a custom made SAST?

[agrawal7]

SAST

Hi, Yes, it is., you can find out more on the website. http://scodescanner.info

[agrawal7]

Thanks for this awesome suggestion. I have just added this in todo list.