Home
The first project general release (1.0) was on 12/16/19. It was previously presented for the first time at SecTor 2019.
Application Inspector's primary objective is to identify source code features in a systematic and scalable way not found elsewhere in typical static analyzers. This enables developer and security professionals to validate purported component objectives e.g. a string padding library only does what it says.
Modern applications rely heavily on software written outside of your company which comes with risks. Application Inspector can help identify interesting characteristics of an application by examining source code saving significant time over performing this manually.
Knowing what is in your software is the first step to making key choices about what actions are appropriate before allowing it to be deployed in your own or to customer environments. Our tool includes hundreds of default identifying patterns for detecting general features like frameworks used, file I/O, OS API's as well as the ability to detect key security and privacy features of a component.
By default Application Inspector generates a browser based output for illustrating the features, project summary and meta-data detected. It also supports JSON and TEXT output format options.
Additionally, it includes a confidence indicator (and filter) as well as the ability to drill down to the code file area where the match was found.
While other tools play an important role in automating detection of vulnerabilities and poor security or other coding practices, Application Inspector helps to answer the question what is in it? Application Inspector is judgement free, focusing instead on helping inform security and other scenarios by surfacing details that might otherwise go unnoticed.
Note: It does not take the place of a security code review or security static analyzer but in a fast paced and highly automated driven development world, this is an important addition to your toolset.
Well constructed and hidden backdoors can go undetected by a tool that is only looking for poor security programming practices because it doesn’t look at context at a feature level.
- Characterizing key features of source code
- Detecting sudden feature changes between component versions
- Mapping detected features to security requirements (enabling-only)
- True/false testing for specific features vs entire set
- Dynamic Code Execution
- Process Management
- Encryption
- Hashing
- Secrets
- Randomization
- File System
- Environment Variables
- Network Operations
- User Accounts
- Windows Registry
- JSON/XML
- Secrets / Access Keys
- Sensitive Personal Data
- SQL / ORM
- Object Serialization (XML/JSON)
- Flash, PDF, Silverlight
- Audio/Video Media Use or Parsing
- Bluetooth, Cellular, RPC
- Development
- Testing
- Dependencies
- Cloud Services (Data Storage, Applications, Social Media)
To see a complete set of unique 'tags' supported for feature identification, use the 'exporttags' command or simply review the default ruleset under the /rules/default folder.
- DevOps Engineers - View source code characteristics at a feature level to determine if a component contains only what is expected. Use to compare and find alternates to identify sudden and unexpected feature changes of significance.
- IT Security Auditors - Evaluate risk presented when third-party software is included in solution source.
The application is a client .NET Core based tool so it will run on Windows, Linux or macOS and does not require elevated privileges and there is no local database or network communications or telemetry. To run it , simply use the standard dotnet command line to invoke i.e. dotnet ApplicationInspector.dll if you are on a Linux or macOS system or if you are on Windows AppInspector.exe. See the readme or more on command options or the built-in help.
- Download a component in compressed or uncompressed formats
- Run Application Inspector pointing it at the component source code, specifying the command, report format and other options. See Readme.md for more.
There are two primary ways to customize the content of the report results:
- Custom Rules (feature pattern to scan for e.g. regex, language)
- Custom Report (filter what features to display in the report output)
You may add/edit/remove default rules or patterns as needed. We've worked hard to identify a large default starting set for the first release. You can also add your own rules in a separate path to the default set and retain the default set or exclude them using command line options. See help for more and this wiki for how to on rules schema
Application Inspector builds both an HTML output.html report and output.json report files which are organized dynamically around indicated preferred tags found in the preferences files. To customize a report, see Customized Reports