Yasca

Yasca
DeveloperMichael Scovetta
Stable release
2.2 / June 4, 2010; 16 years ago (2010-06-04)
Written inPHP, Java
Operating systemCross-platform
Size12MB-155MB
Available inEnglish
TypeSoftware Quality, Software Security
LicenseBSD License, GPL License, GNU Lesser General Public License, Others
Websiteyasca.org,
sourceforge.net/projects/yasca/

Yasca is an open source program which looks for security vulnerabilities, code-quality, performance, and conformance to best practices in program source code. It leverages external open source programs, such as FindBugs, PMD, JLint, JavaScript Lint, PHPLint, Cppcheck, ClamAV, Pixy, and RATS to scan specific file types,[1] and also contains many custom scanners developed for Yasca. It is a command-line tool that generates reports in HTML, CSV, XML, MySQL, SQLite, and other formats. It is listed as an inactive project at the well-known OWASP security project,[2] and also in a government software security tools review at the U.S Department of Homeland Security web site.[3]

Languages Scanned

Yasca has at least one scanner for each of the following file types:

  • .NET (VB.NET, C#, ASP.NET)
  • ASP
  • C/C++
  • COBOL
  • ColdFusion
  • CSS
  • HTML
  • Java
  • JavaScript
  • Perl
  • PHP
  • Python
  • Raw HTTP Traffic
  • Visual Basic

Yasca 2.2

Version 2.2 was released in June 2010 and included a large number of minor updates over version 2.1, most notably, natively compiled plugins on Linux, reducing the need to use Wine. Version 2.2 contains some experimental modules, including a TCP packet logger and a rule to scan those logs for sensitive information. Additional rules for this are expected in the next update.

As with prior 2.x releases, Yasca comes packaged as a core bundle, plus separately downloadable plugins. No plugins are required, but best results occur when using all of the necessary plugins.

References

  1. ^ Clarke, Justin (2009). SQL Injection Attacks and Defense. Syngress. p. 125. ISBN 978-1-59749-424-3.
  2. ^ "Category:OWASP Yasca Project". OWASP. Archived from the original on 1 September 2010. Retrieved 14 September 2010.
  3. ^ "Software Security Assessment Tools Review" (PDF). Homeland Security. Archived from the original (PDF) on 2010-05-28. Retrieved 14 September 2010.

Content Disclaimer

Informasi ini disarikan dari Wikipedia dan disajikan kembali untuk tujuan edukasi. Konten tersedia di bawah lisensi CC BY-SA 3.0. Kami tidak bertanggung jawab atas ketidakakuratan data yang bersumber dari kontribusi publik tersebut.

  1. The information displayed on this website is sourced in part or in whole from Wikipedia and has been adapted for the purpose of restating it. We strive to provide accurate and relevant information, however:
  2. There is no guarantee of absolute accuracy. Wikipedia is an open, collaborative project that can be edited by anyone, so information is subject to change.
  3. It is not intended to constitute professional advice. The content displayed is for informational and educational purposes only. For important decisions (e.g., medical, legal, or financial), please consult a professional.
  4. Content copyright. Wikipedia is licensed under the Creative Commons Attribution-ShareAlike License (CC BY-SA). This means that content may be reused with appropriate attribution and shared under a similar license.
  5. Responsible use. Any risk arising from the use of information from this website is entirely the responsibility of the user.