Free for Open Source Application Security Tools - Revision history

Wichers: /* IAST Tools */

2019-10-24T15:41:47Z

‎IAST Tools

Wichers: /* Free for Open Source Tools */

2019-10-24T15:40:42Z

‎Free for Open Source Tools

Koussa: Changed the reshift link to point to the new website.

2019-10-21T19:12:57Z

Changed the reshift link to point to the new website.

Dirk Wetter: "open source" was not appropriate here -- unless there's a link to the open source code (+ license). It seems to be closed source to me which is available after registration.

2019-03-21T10:30:54Z

"open source" was not appropriate here -- unless there's a link to the open source code (+ license). It seems to be closed source to me which is available after registration.

Wichers at 16:31, 23 January 2019

2019-01-23T16:31:43Z

Wichers: /* Free for Open Source Tools */

2018-11-07T21:12:12Z

‎Free for Open Source Tools

Wichers: /* Detecting Known Vulnerable Components */

2018-10-23T21:56:57Z

‎Detecting Known Vulnerable Components

Wichers: Add SourceClear to list of Detecting Vulnerable Components Tools

2018-10-23T21:42:40Z

Add SourceClear to list of Detecting Vulnerable Components Tools

Wichers: Add Snyk CLI instructions

2018-10-23T21:03:23Z

Add Snyk CLI instructions

Wichers: /* Detecting Known Vulnerable Components */

2018-10-18T14:55:19Z

‎Detecting Known Vulnerable Components

@@ Line 33: / Line 33: @@
 We are aware of only one IAST Tool that is free after registration at this time:
-* [https://www.contrastsecurity.com/contrast-community-edition Contrast Community Edition (CE)] - Fully featured version for 1 app and up to 5 users (some Enterprise features disabled). Contrast CE supports Java only.
+* [https://www.contrastsecurity.com/contrast-community-edition Contrast Community Edition (CE)] - Fully featured version for 1 app and up to 5 users (some Enterprise features disabled). Contrast CE supports Java and .NET only.
 === Open Source Software (OSS) Security Tools ===

@@ Line 17: / Line 17: @@
 === SAST Tools ===
 OWASP already maintains a page of known SAST tools: [[Source Code Analysis Tools]], which includes a list of those that are "Open Source or Free Tools Of This Type". Any such tools could certainly be used. One such cloud service that looks promising is:
-* [https://lgtm.com/help/lgtm/about-lgtm LGTM.com] - A free for open source static analysis service that automatically monitors commits to publicly accessible code in: Bitbucket Cloud, GitHub, or GitLab. Supports C/C++, C#, COBOL (in beta), Java, JavaScript/TypeScript, Python
+* [https://lgtm.com/help/lgtm/about-lgtm LGTM.com] - A free for open source static analysis service that automatically monitors commits to publicly accessible code in: Bitbucket Cloud, GitHub, or GitLab. Supports C/C++, C#, COBOL (in beta), Go (in beta), Java, JavaScript/TypeScript, Python
 In addition, we are aware of the following commercial SAST tools that are free for Open Source projects:
 * [https://scan.coverity.com/ Coverity Scan Static Analysis] - Can be lashed into Travis-CI so it's done automatically with online resources. Supports over a dozen programming languages as documented here in the section [https://www.synopsys.com/software-integrity/security-testing/static-analysis-sast.html Comprehensive support for these programming languages and frameworks].

@@ Line 20: / Line 20: @@
 In addition, we are aware of the following commercial SAST tools that are free for Open Source projects:
 * [https://scan.coverity.com/ Coverity Scan Static Analysis] - Can be lashed into Travis-CI so it's done automatically with online resources. Supports over a dozen programming languages as documented here in the section [https://www.synopsys.com/software-integrity/security-testing/static-analysis-sast.html Comprehensive support for these programming languages and frameworks].
-* [https://www.softwaresecured.com/reshift reshift] - A CI/CD tool that uses static code analysis to scan for vulnerabilities and uses machine learning to give a prediction on false positives. Supports Java with future support for NodeJS and JavaScript planned for sometime in 2019. If you go to the Pricing section on this page, it says it is free for public repositories.
+* [https://www.reshiftsecurity.com reshift] - A CI/CD tool that uses static code analysis to scan for vulnerabilities and uses machine learning to give a prediction on false positives. Supports Java with future support for NodeJS and JavaScript planned for sometime in 2019. If you go to the Pricing section on this page, it says it is free for public repositories.
 === DAST Tools ===

@@ Line 32: / Line 32: @@
 IAST tools are typically geared to analyze Web Applications and Web APIs, but that is vendor specific. There may be IAST products that can perform good security analysis on non-web applications as well.
-We are aware of only one IAST Tool that is free for open source at this time:
+We are aware of only one IAST Tool that is free after registration at this time:
 * [https://www.contrastsecurity.com/contrast-community-edition Contrast Community Edition (CE)] - Fully featured version for 1 app and up to 5 users (some Enterprise features disabled). Contrast CE supports Java only.

@@ Line 20: / Line 20: @@
 In addition, we are aware of the following commercial SAST tools that are free for Open Source projects:
 * [https://scan.coverity.com/ Coverity Scan Static Analysis] - Can be lashed into Travis-CI so it's done automatically with online resources. Supports over a dozen programming languages as documented here in the section [https://www.synopsys.com/software-integrity/security-testing/static-analysis-sast.html Comprehensive support for these programming languages and frameworks].
 === DAST Tools ===

@@ Line 60: / Line 60: @@
 ** If you don't want to grant Snyk write access to your repo (see it can auto-create pull requests) you can use the Command Line Interface (CLI) instead. See: https://snyk.io/docs/using-snyk. If you do this and want it to be free, you have to configure Snyk so it know its open source: https://support.snyk.io/snyk-cli/how-can-i-set-a-snyk-cli-project-as-open-source
 *** Another benefit of using the Snyk CLI is that it won't auto create Pull requests for you (which makes these 'issues' more public than you might prefer)
 * SourceClear - https://www.sourceclear.com/ - Supports: Java, Ruby, JavaScript, Python, Objective C, GO, PHP
 ** They have a free trial right from their [https://www.sourceclear.com/ home page]. When the 30 day trial expires, it converts into a free "Personal Account" per: "Upgrade at any time to get the features that matter most to you, or choose the Personal plan when your trial ends." Personal Account described here: https://www.sourceclear.com/pricing/
-** They also make their component vulnerability data free to search: https://www.sourceclear.com/vulnerability-database/search#_ (Very useful when trying to research a particular library)
+** They also make their component vulnerability data (for publicly known vulns) free to search: https://www.sourceclear.com/vulnerability-database/search#_ (Very useful when trying to research a particular library)
 * WhiteSource Bolt - Supports 200+ programming languages. https://www.whitesourcesoftware.com/
 ** Azure version: https://marketplace.visualstudio.com/items?itemName=whitesource.ws-bolt

@@ Line 56: / Line 56: @@
 Commercial tools of this type that are free for open source:
 * Contrast Community Edition (CE) (mentioned earlier) also has both Known Vulnerable Component detection and Available Updates reporting for OSS. CE supports Java only.
-* Snyk - https://www.snyk.io
+* Snyk - https://www.snyk.io - Supports Node.js, Ruby, Java, Python, Scala, Golang, .NET, PHP - Latest list here: https://snyk.io/docs
 ** A Commercial tool that identifies vulnerable components and integrates with numerous CI/CD pipelines. It is free for open source: https://snyk.io/plans
-** Supports Node.js, Ruby, Java, Python, Scala, Golang, .NET, PHP - Latest list here: https://snyk.io/docs
+** If you don't want to grant Snyk write access to your repo (see it can auto-create pull requests) you can use the Command Line Interface (CLI) instead. See: https://snyk.io/docs/using-snyk. If you do this and want it to be free, you have to configure Snyk so it know its open source: https://support.snyk.io/snyk-cli/how-can-i-set-a-snyk-cli-project-as-open-source
 * WhiteSource Bolt - Supports 200+ programming languages. https://www.whitesourcesoftware.com/
 ** Azure version: https://marketplace.visualstudio.com/items?itemName=whitesource.ws-bolt