GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → thesp0nge → Owasp Orizon

thesp0nge / Owasp Orizon

Licence: apache-2.0
Owasp Orizon is a source code static analyzer tool designed to spot security issues in Java applications.

Programming Languages

java
68154 projects - #9 most used programming language

Labels

static-code-analysisvulnerability-scannersowaspcode-review

Projects that are alternatives of or similar to Owasp Orizon

FastLint-Issues
FastLint finds & fixes bugs in your commits
Stars: ✭ 123 (-5.38%)
Mutual labels:  static-code-analysis, code-review
Vbscan
OWASP VBScan is a Black Box vBulletin Vulnerability Scanner
Stars: ✭ 295 (+126.92%)
Mutual labels:  vulnerability-scanners, owasp
Progpilot
A static analysis tool for security
Stars: ✭ 226 (+73.85%)
Mutual labels:  vulnerability-scanners, static-code-analysis
Sbt Dependency Check
SBT Plugin for OWASP DependencyCheck. Monitor your dependencies and report if there are any publicly known vulnerabilities (e.g. CVEs). 🌈
Stars: ✭ 187 (+43.85%)
Mutual labels:  vulnerability-scanners, owasp
Jackhammer
Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.
Stars: ✭ 633 (+386.92%)
Mutual labels:  vulnerability-scanners, static-code-analysis
Reviewdog
🐶 Automated code review tool integrated with any code analysis tools regardless of programming language
Stars: ✭ 4,541 (+3393.08%)
Mutual labels:  code-review, static-code-analysis
qodana-action
⚙️ Scan your Java, Kotlin, PHP, Python, JavaScript, TypeScript projects at GitHub with Qodana
Stars: ✭ 112 (-13.85%)
Mutual labels:  static-code-analysis, code-review
Nettacker
Automated Penetration Testing Framework
Stars: ✭ 982 (+655.38%)
Mutual labels:  vulnerability-scanners, owasp
Security Code Scan
Vulnerability Patterns Detector for C# and VB.NET
Stars: ✭ 550 (+323.08%)
Mutual labels:  owasp, static-code-analysis
Raptor
Web-based Source Code Vulnerability Scanner
Stars: ✭ 314 (+141.54%)
Mutual labels:  vulnerability-scanners, code-review
Joomscan
OWASP Joomla Vulnerability Scanner Project
Stars: ✭ 640 (+392.31%)
Mutual labels:  vulnerability-scanners, owasp
Feram
Feram finds & fixes bugs in your commits
Stars: ✭ 122 (-6.15%)
Mutual labels:  code-review, static-code-analysis
Phpstan
PHP Static Analysis Tool - discover bugs in your code without running it!
Stars: ✭ 10,534 (+8003.08%)
Mutual labels:  static-code-analysis
Php Malware Detector
PHP malware detector
Stars: ✭ 121 (-6.92%)
Mutual labels:  vulnerability-scanners
Owtf
Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient http://owtf.org https://twitter.com/owtfp
Stars: ✭ 1,516 (+1066.15%)
Mutual labels:  owasp
Gda Android Reversing Tool
GDA is a new fast and powerful decompiler in C++(working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, dat…
Stars: ✭ 2,332 (+1693.85%)
Mutual labels:  vulnerability-scanners
Awesome Hacking Resources
A collection of hacking / penetration testing resources to make you better!
Stars: ✭ 11,466 (+8720%)
Mutual labels:  owasp
Grepbugs
A regex based source code scanner.
Stars: ✭ 118 (-9.23%)
Mutual labels:  static-code-analysis
Patrowldocs
PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform
Stars: ✭ 105 (-19.23%)
Mutual labels:  vulnerability-scanners
Drek
A static-code-analysis tool for performing security-focused code reviews. It enables an auditor to swiftly map the attack-surface of a large application, with an emphasis on identifying development anti-patterns and footguns.
Stars: ✭ 103 (-20.77%)
Mutual labels:  static-code-analysis
View All Similar Projects ➔

The Owasp Orizon project

Owasp Orizon is a source code static analyzer tool designed to spot security issues in Java applications.

The history

It was a dark and stormy night in Milan, Italy. It was 2006 and I felt the need of something helping me in reviewing other people java source code. So Owasp Orizon born and grew up as security tool trying to parse Java source code, building an Abstract Syntax Tree and spot for unsafe calls in the code.

In the very beginning Owasp Orizon was a sort of enhanced grep tool. In 2008, I started supporting PHP programming language but the initial boost disappeared. After being in love with other programming languages and technolgies, eight years later, in 2016 I kickstarted the project again from scratch.

The typo

The mission

Source code contains bugs and vulnerabilities. Owasp Orizon will help either application security specialists or developersto spot vulnerabilities in their code and to create security patches.

Owasp Orizon mission is to provide people an opensource tool, helping them in reviewing:

  • single Java classes
  • java standalone tools packed in JAR files
  • web applications packed in EAR / WAR files
  • Android APK applications

An overall introduction

When you launch Owasp Orizon it will start unpkacing the target file if not a standalone .class file.

First security analysis stage is about vulnerabilities from third party libraries. Owasp Orizon will try to understand target package dependencies and than look for known security issues.

As knowledge base for third party library vulnerabilities, Owasp Orizon will support:

  • vFeed.io database. Please note that we don't redistribute the database. You must go on vFeed website and purchase the license that best fits your tool usage
  • CVE archive from NVD

After this stage, Owasp Orizon will perform a walkthrough on Owasp TOP 10 security risks, using Apache BCEL library to disassemble java bytecode.

Usage

More a reminder than a real doc here

java -Dlog4j.configurationFile=./log4j2.xml -jar target/owasp-orizon-1.0-SNAPSHOT.jar

The overall design

To be written

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].