CodeCat is an open-source tool to help you find/track user input sinks and security bugs using static code analysis. These points follow regex rules.

Current rules for C,C++,GO,Python,javascript,Swift,PHP,Ruby,ASP,Kotlin,Dart and Java.(you can create your rules)

https://www.youtube.com/watch?v=Bmfhsr3BvyA

Go to CodeCat directory, install backend and frontend libs:

$ cd Front
$ sudo python3 -m pip install -r requirements.txt
$ cd ..
$ cd Backend
$ sudo python3 -m pip install -r requirements.txt

Run backend and frontend:

$ cd Codecat
$ cd Frontend; python3 wsgi.py &
$ cd ..
$ cd Backend; python3 wsgi.py &

Next step you need save your user to login:

$ curl -i -X POST -H "Content-Type: application/json" -d '{"email":"[email protected]","username":"admin","password":"rubrik123"}' https://127.0.0.1:50001/api/users -k

These endpoint /API/users run only once in the first deployment. If you try to send a request again to insert a user, the endpoint return 404 is security to block resources of possible attacks.

Go to the following "https://127.0.0.1:50093/front/auth/". Now you can enter this system-auth, use login "admin", pass "rubrik123".

Note About TLS: You can configure and load your TLS cert in "wsgi.py".

Suppose you need to run in production. So I recommend another way.

$ gunicorn -b 127.0.0.1:50001 wsgi:app

If you want, you can use TLS with CERT resources:

$ gunicorn --certfile=server.crt --keyfile=server.key -b 127.0.0.1:50001 wsgi:app

The same command to frontend, but you need to use port 50093.

Remember, codecat have a function to recursive reading in the directory. This function with user input is a dangerous issue called "path traversal". Use this tool in a controlled place. My machine is a local virtual machine to run a codecat. Looking at the firewall context, you can block different IP addresses to limit access of codecat for example.

Please study the doc. https://github.com/CoolerVoid/codecat/blob/master/doc/raptor.pdf

So any questions, create an issue, and I can try to help you.

The purpose of this tool is to use in code review, take attention if you have a proper authorization before to use that. I do not have responsibility for your actions. You can use a hammer to construct a house or destroy it, choose the law path, don't be a bad guy, remember.

github.com/CoolerVoid Antonio Costa - [email protected]