SourceCodeSniffer

The Source Code Sniffer is a poor man’s static code analysis tool (SCA) designed to highlight high risk functions (Injection, LFI/RFI, file uploads etc) across multiple web application development languages (ASP, Java, CSharp, PHP, Perl, Python, JavaScript, HTML etc) in a highly configurable manner. Source Code Sniffer is written in Python 2.7 and supports both Windows and Linux.

Static Code Analysis Features and Languages

Language	SQL Injection	LFI/RFI	XSS	File Traversal	File Uploads	XML Injection	JSON Injection	Command Injection	LDAP Injection
PHP
Python
Node.js
GO
ASP Classic	✔	✔
ASP.NET	✔
JAVA
JavaScript
Ruby
Ruby
Perl
HTML
HTML5
VBScript

##Syntax help

python SourceCodeSniffer.py -h

- Command Line Usage
	``# C:/Users/Haxz0r/PycharmProjects/SourceCodeSniffer/SourceCodeSniff [options]``

Options
-------
====================== ==============================================================
-c --configFiles        specify the config files (default=['Default.ini', 'ASP.ini', 'CSharp.ini'])
                        config files should be comma separated
-p --pathToScan         specify the path to scan (default=.)
                        use the forward slash / for both *nix and windows paths
-i --ignoreFiles        specify files to not scan (default=('.html', '.js', 'robots.txt'))
                        ignored files and file types should be comma separated 
-v --verbose            verbose mode
-d --debug              show debug output
-l --log                output to log file
====================== ==============================================================
Example:
 python SourceCodeSniffer.py -c ASP.ini,CSharp.ini,Default.ini,VBScript.ini -p c:/testpath/test/ -i .html,robots.txt