This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Free for Open Source Application Security Tools"
(Initial release) |
m |
||
| Line 26: | Line 26: | ||
** The ZAP team has also been working hard to make it easier to integrate ZAP into your CI/CD pipeline. (e.g., here's a [https://www.we45.com/blog/how-to-integrate-zap-into-jenkins-ci-pipeline-we45-blog blog post on how to integrate ZAP with Jenkins]). | ** The ZAP team has also been working hard to make it easier to integrate ZAP into your CI/CD pipeline. (e.g., here's a [https://www.we45.com/blog/how-to-integrate-zap-into-jenkins-ci-pipeline-we45-blog blog post on how to integrate ZAP with Jenkins]). | ||
* [http://www.arachni-scanner.com/ Arachni] - Arachni is a commercially supported scanner, but its free for most use cases, including scanning open source projects. | * [http://www.arachni-scanner.com/ Arachni] - Arachni is a commercially supported scanner, but its free for most use cases, including scanning open source projects. | ||
| − | We are not aware of any other commercial grade tools that offer their full featured DAST product free for open source projects. | + | We are not aware of any other commercial grade tools that offer their full featured DAST product free for open source projects. |
=== IAST Tools === | === IAST Tools === | ||
| Line 32: | Line 32: | ||
We are aware of only one IAST Tool that is free for open source at this time: | We are aware of only one IAST Tool that is free for open source at this time: | ||
| − | * [https://www.contrastsecurity.com/contrast-community-edition Contrast Community Edition] - | + | * [https://www.contrastsecurity.com/contrast-community-edition Contrast Community Edition] - Fully featured version for 1 app and up to 5 users (some Enterprise features disabled). Supports Java, .NET, NodeJS, and Ruby. |
=== Library Analysis Tools === | === Library Analysis Tools === | ||
| Line 43: | Line 43: | ||
* Dependabot - https://dependabot.com/ | * Dependabot - https://dependabot.com/ | ||
** A GitHub only service that creates pull requests to keep your dependencies up-to-date. It automatically generates a pull request for each dependency you can upgrade, which you can then ignore, or accept, as you like. It supports tons of languages. | ** A GitHub only service that creates pull requests to keep your dependencies up-to-date. It automatically generates a pull request for each dependency you can upgrade, which you can then ignore, or accept, as you like. It supports tons of languages. | ||
| − | ** | + | ** Recommended for all open source projects maintained on GitHub! |
==== Detecting Known Vulnerable Components ==== | ==== Detecting Known Vulnerable Components ==== | ||
| Line 50: | Line 50: | ||
We are aware of only one commercial tool of this type that is free for open source at this time: | We are aware of only one commercial tool of this type that is free for open source at this time: | ||
* Snyk - https://www.snyk.io | * Snyk - https://www.snyk.io | ||
| − | ** A Commercial tool similar | + | ** A Commercial tool similar to OWASP Dependency Check, that is free for open source: https://snyk.io/plans |
=== Code Quality tools === | === Code Quality tools === | ||
| Line 56: | Line 56: | ||
* SpotBugs (https://github.com/spotbugs/spotbugs) - Open source code quality tool for Java | * SpotBugs (https://github.com/spotbugs/spotbugs) - Open source code quality tool for Java | ||
** This is the active fork for FindBugs, so if you use Findbugs, you should switch to this. | ** This is the active fork for FindBugs, so if you use Findbugs, you should switch to this. | ||
| − | ** | + | ** SpotBugs users should add the FindSecBugs plugin (http://find-sec-bugs.github.io/) to their SpotBugs setup, as it significantly improves on the very basic security checking native to SpotBugs. |
* SonarQube (https://www.sonarqube.org/) | * SonarQube (https://www.sonarqube.org/) | ||
Revision as of 15:40, 4 October 2018
Introduction
OWASP's mission is to help the world improve the security of its software. One of the best ways OWASP can do that is to help Open Source developers improve the software they are producing that everyone else relies on. As such, the following lists of automated vulnerability detection tools that are free for open source projects have been gathered together here to raise awareness of their availability.
We would encourage open source projects to use the following types of tools to improve the security and quality of their code:
- Static Application Security Testing (SAST) Tools
- Dynamic Application Security Testing (DAST) Tools - (Primarily for web apps)
- Interactive Application Security Testing (IAST) Tools - (Primarily for web apps)
- Keeping libraries up-to-date (to avoid Using Components with Known Vulnerabilities (OWASP Top 10-2017 A9))
- Static Code Quality Tools
Disclaimer: OWASP does not endorse any of the Vendors or Scanning Tools by listing them below. They are simply listed if we believe they are free for use by open source projects. We have made every effort to provide this information as accurately as possible. If you are the vendor of a free for open source tool and think this information is incomplete or incorrect, please send an e-mail to dave.wichers (at) owasp.org) and we will make every effort to correct this information.
Free for Open Source Tools
Tools that are free for open source projects in each of the above categories are listed below.
SAST Tools
OWASP already maintains a page of known SAST tools: Source Code Analysis Tools, which includes a list of those that are "Open Source or Free Tools Of This Type". Any such tools could certainly be used.
In addition, we are aware of the following commercial SAST tools that are free for Open Source projects:
- Coverity Scan Static Analysis - Can be lashed into Travis-CI so it's done automatically with online resources.
DAST Tools
If your project has a web application component, we recommend running automated scans against it to look for vulnerabilities. OWASP maintains a page of known DAST Tools: Vulnerability Scanning Tools, and the Licence column on this page indicates which of those tools have free capabilities. Our primary recommendation is to use one of these:
- OWASP ZAP - A full featured free and open source DAST tool that includes both automated scanning for vulnerabilities and tools to assist expert manual web app pen testing.
- The ZAP team has also been working hard to make it easier to integrate ZAP into your CI/CD pipeline. (e.g., here's a blog post on how to integrate ZAP with Jenkins).
- Arachni - Arachni is a commercially supported scanner, but its free for most use cases, including scanning open source projects.
We are not aware of any other commercial grade tools that offer their full featured DAST product free for open source projects.
IAST Tools
IAST tools are typically geared to analyze Web Applications, but that is vendor specific. There may be IAST products that can perform good security analysis on non-web applications as well.
We are aware of only one IAST Tool that is free for open source at this time:
- Contrast Community Edition - Fully featured version for 1 app and up to 5 users (some Enterprise features disabled). Supports Java, .NET, NodeJS, and Ruby.
Library Analysis Tools
OWASP recommends that all software projects generally try to keep the libraries they use as up-to-date as possible to reduce the likelihood of Using Components with Known Vulnerabilities (OWASP Top 10-2017 A9). There are two recommended approaches for this:
Keeping Your Libraries Updated
Using the latest version of each library is recommended because security issues are frequently fixed 'silently' by the component maintainer. By silently, we mean without publishing a CVE for the security fix.
- Maven Versions plugin
- For Maven projects, can be used to generate a report of all dependencies used and when upgrades are available for them. Either a direct report, or part of the overall project documentation using: mvn site.
- Dependabot - https://dependabot.com/
- A GitHub only service that creates pull requests to keep your dependencies up-to-date. It automatically generates a pull request for each dependency you can upgrade, which you can then ignore, or accept, as you like. It supports tons of languages.
- Recommended for all open source projects maintained on GitHub!
Detecting Known Vulnerable Components
As an alternative, or in addition to, trying to keep all your components up-to-date, a project can specifically monitor whether any of the components they use have known vulnerable components.
- OWASP has its own free open source tool OWASP Dependency Check that is free for anyone to use.
We are aware of only one commercial tool of this type that is free for open source at this time:
- Snyk - https://www.snyk.io
- A Commercial tool similar to OWASP Dependency Check, that is free for open source: https://snyk.io/plans
Code Quality tools
Quality has a significant correlation to security. As such, we recommend open source projects also consider using good code quality tools. A few that we are aware of are:
- SpotBugs (https://github.com/spotbugs/spotbugs) - Open source code quality tool for Java
- This is the active fork for FindBugs, so if you use Findbugs, you should switch to this.
- SpotBugs users should add the FindSecBugs plugin (http://find-sec-bugs.github.io/) to their SpotBugs setup, as it significantly improves on the very basic security checking native to SpotBugs.
- SonarQube (https://www.sonarqube.org/)
- This is a commercially supported, very popular, free (and commercial) code quality tool. It includes most if not all the FindSecBugs security rules plus lots more for quality, including a free, internet online CI setup to run it against your open source projects. SonarQube supports numerous languages: https://www.sonarqube.org/features/multi-languages/
Please let us know if you are aware of any other high quality application security tools that are free for open source (or simply add them to this page). We are particularly interested in identifying and listing commercial tools that are free for open source, as they tend to be much better than open source (free) tools. If you are aware of any missing from this list, please add them, or let us know (dave.wichers (at) owasp.org) and we'll confirm they are free, and add them for you. Please encourage your favorite commercial tool vendor to make their tool free for open source projects as well!!
Finally, please forward this page to the open source projects you rely on and encourage them to use these free tools!
