PHP-Insider

PHP-Insider is a static application security testing tool (SAST), which is specialized in finding dangerous sinks. It's not designed to be a fully-automated tool for identifying vulnerabilities, but rather an aid for analysts finding them.

Warning! This repository is currently under development and may contain breaking changes.

Installation

If this tool is used without docker, you have to install php ^8.2, ext-dom, ext-simplexml, ext-tokenizer, ext-xml, ext-xmlwriter, and composer.

1. Clone repository

   git clone https://github.com/angelej/php-insider.git
   cd php-insider

2. Install dependencies

   composer install

Basic Usage

Without using Docker

insider@linux:~$ ./bin/insider analyse /path/to/app
   ExecSink  found in file src/Command.php › Ⓒ Command › ⓜ execute 
        5▕     public function execute(string $cmd){
        6▕ 
    ➜   7▕         return exec($cmd);
        8▕     }
        9▕ }


   Summary:  1 sink found

Using Docker

insider@linux:~$ docker run --rm -it -v /path/to/app:/app angelej/php-insider:latest analyse /app/src
   ExecSink  found in file src/Command.php › Ⓒ Command › ⓜ execute 
        5▕     public function execute(string $cmd){
        6▕ 
    ➜   7▕         return exec($cmd);
        8▕     }
        9▕ }


   Summary:  1 sink found

Level

The level can be defined using the -l|--level command option. The higher the level, the more selective the analysis.

Level	Description
0 (default)	all supported sinks
1	sinks with dynamic variables

Supported Sinks

Code Execution

• `backtick`
• eval()
• exec()
• passthru()
• pcntl_exec()
• popen()
• proc_open()
• shell_exec()
• system()

File Inclusion

• include()
• include_once()
• require()
• require_once()

File Read

• file_get_contents()
• file()
• readfile()

File Write

• copy()
• file_put_contents()
• link()
• move_uploaded_file()
• symlink()

Information Disclosure

• phpinfo()

Testing

composer test

Security Vulnerabilities

If you discovered a security vulnerability, please send an e-mail to jeremy.angele@proton.me. All security vulnerabilities will be promptly addressed.