Meta tags:
keywords=static, code, analysis, tool, free, regex, cifrex, download, man, regular expression, cwe, cve, stuff, security, research, maksymilian, arciemowicz, kacper rybczynski, ;
description=cIFrex is a web application helping to search for mistakes in the analysis of the source code. Free static code analysis tool ready for automation;
description=;

Headings (most frequently used words):

sh, cifrex, to, use, v1, cwe, char, cve, and, install, start, stop, remove, if, db, name, strcpy, null, the, configuration, php, static, code, analysis, tool, search, or, on, cxsecurity, com, installation, system, requirements, http, 127, 3380, exportdb, how, download, common, weakness, enumeration, history, authors, license, success, login, pass, export, 128, v2, support, find, xargs, grep, you, can, change, in, your, file, edit, src, config, files, customize, connection, other, settings,

Text of the page (most frequently used words):
the (141), #cifrex (44), and (34), use (23), this (21), code (20), for (18), regular (18), version (17), can (17), expressions (16), are (13), with (12), that (12), not (12), search (12), you (11), will (11), which (11), cwe (11), type (10), example (10), expression (9), name (8), cxsecurity (8), analysis (8), program (8), null (8), 2017 (7), without (7), used (7), software (7), any (7), static (7), license (7), com (7), download (7), given (7), all (6), other (6), tool (6), more (6), php (6), https (6), team (5), but (5), org (5), has (5), release (5), does (5), mistake (5), mistakes (5), function (5), strcpy (5), char (5), docker (5), copyright (4), source (4), conditions (4), its (4), possibility (4), gnu (4), public (4), have (4), http (4), help (4), script (4), research (4), error (4), finding (4), after (4), patterns (4), find (4), during (4), each (4), filter (4), results (4), file (4), fulfilled (4), using (4), files (4), configuration (4), true (4), 2012 (3), provided (3), following (3), must (3), names (3), from (3), implied (3), including (3), kacper (3), rybczynski (3), however (3), free (3), modify (3), general (3), your (3), remember (3), 2013 (3), let (3), filters (3), found (3), also (3), analyse (3), susceptibilities (3), pointer (3), dereference (3), maximum (3), try (3), database (3), about (3), git (3), appearance (3), probability (3), functions (3), when (3), values (3), variables (3), create (3), start (3), directory (3), based (3), 127 (3), install (3), binary (2), redistributions (2), above (2), notice (2), list (2), disclaimer (2), may (2), warranties (2), limited (2), merchantability (2), fitness (2), particular (2), purpose (2), maksymilian (2), arciemowicz (2), data (2), liability (2), way (2), even (2), such (2), under (2), hope (2), useful (2), warranty (2), see (2), details (2), should (2), copy (2), language (2), available (2), off (2), guarantee (2), they (2), large (2), effects (2), time (2), vsftpd (2), remote (2), service (2), multiple (2), libc (2), fnmatch (2), apache (2), helped (2), many (2), detailed (2), library (2), been (2), idea (2), thanks (2), several (2), first (2), originated (2), some (2), product (2), efficiency (2), nine (2), seen (2), grep (2), system (2), cve (2), mitre (2), encourage (2), official (2), high (2), our (2), only (2), means (2), enabling (2), reach (2), kind (2), helps (2), larger (2), there (2), usage (2), know (2), these (2), mentioned (2), risky (2), manner (2), controlling (2), length (2), line (2), array (2), table (2), size (2), through (2), three (2), process (2), interesting (2), allows (2), change (2), default (2), mainly (2), variable (2), present (2), false (2), truth (2), sequences (2), webserver (2), bind (2), port (2), 3380 (2), basic (2), use_docker_db (2), export (2), remove (2), stop (2), security (2), rights, reserved, redistribution, forms, modification, permitted, met, retain, form, reproduce, documentation, materials, distribution, neither, nor, contributors, endorse, promote, products, derived, specific, prior, written, permission, express, disclaimed, event, shall, liable, direct, indirect, incidental, special, exemplary, consequential, damages, procurement, substitute, goods, services, loss, profits, business, interruption, caused, theory, whether, contract, strict, tort, negligence, otherwise, arising, out, advised, damage, redistribute, terms, published, foundation, either, option, later, distributed, received, along, www, licenses, center, completely, base, bsdv2, become, author, translating, than, grzegorz, terlikowski, authors, 2015, since, october, joined, developed, kick, findings, rely, hard, work, susceptibility, course, decided, make, least, convince, knowledge, pays, denial, similar, demon, vendors, dos, incl, recurrence, proved, resource, exhaustion, systems, bsd, family, was, shifted, suspension, server, mod_autoindex, 101, caught, research_list, come, upon, optimizing, days, beta, working, six, improved, order, improve, beginning, 2011, created, moment, began, xargs, 2010, netbsd, routine, history, support, visit, site, continually, kept, standard, wlb2, allcwe, therefore, dictionary, accessible, address, world, laboratory, bugtraq, entirely, compatible, equipped, key, signature, information, possession, certificate, examples, occurrence, common, weakness, enumeration, clone, github, maksymiliana, master, codeplex, section, 2018, exact, ways, accurate, bad, alloc, another, dangerous, malloc, realloc, calloc, lacking, allocation, block, returns, control, returned, cause, occur, copying, indicator, board, f2copy, 1000, show, degree, state, occurred, programmers, behaviours, logic, inform, condition, contrast, situation, appear, string, one, application, dynamically, creation, succeeding, case, thoroughly, pattern, types, checked, indicated, shown, mean, susceptible, method, oscillate, level, percent, depending, exactness, gives, scanning, pressing, button, speed, mark, omit, unneeded, filtration, need, specify, what, wish, possible, setting, localization, analyzed, default_directory, fulfils, roles, assign, while, precise, their, put, simply, catch, unsuitable, arrays, strlen, cannot, 128, retrieval, signs, attribution, retrieved, lub, value, divided, groups, describing, together, resources, like, enables, lexical, definition, fast, owasp, identifiers, how, edit, src, config, customize, connection, settings, host, ip_http, port_http, port_https, 33443, authorization, users, instalation, http_user, http_pass, container, import, latest, sql, import_default_db, dbdumps, export_db_every_60sec, ip_db, port_db, 33306, set, password, db_root_pass, changeth1sp455wordnow, exportdb, success, pass, login, installation, requirements, bash, mariadb, dependencies, linux, centos, ubuntu, macos, supported, generate, risk, disable_functions, want, features, were, facilitates, audits, malicious, knowlage, review, able, supports, quickly, locating, failure, home, page,

Text of the page (random words):
cifrex static code analysis cifrex org cifrex org static code analysis tool home page download install cwe license cifrex 5 0 static code analysis tool cifrex is an security tool which supports search for mistakes in the source code during static code analysis using the database of filters based on regular expressions you can quickly locating the code in which the probability of failure is high to be able to use cifrex search you should have basic knowlage about regular expressions and static code review this tool facilitates static code analysis during security audits or finding malicious code by using regular expressions some functions in the code may generate a risk such as for php and disable_functions do you want to know if any of these features were used in your code try cifrex supported os linux centos ubuntu macos dependencies docker bash mariadb installation and system requirements to install cifrex use sh install sh if success use login cifrex pass cifrex http 127 0 0 1 3380 to start cifrex use sh start sh to stop cifrex use sh stop sh to remove cifrex use sh remove sh to export cifrex db use sh exportdb sh you can change the configuration in your configuration file webserver docker configuration bind cifrex service on host and port ip_http 127 0 0 1 port_http 3380 port_https 33443 basic authorization you can create more users after instalation http_user cifrex http_pass cifrex webserver docker configuration create docker container for database use_docker_db true import default db and the latest sql import_default_db true export db to dbdumps directory export_db_every_60sec true bind or use ip and port for db ip_db 127 0 0 1 port_db 33306 set docker db password when use_docker_db true db_root_pass changeth1sp455wordnow edit src config php files to customize the db connection and other php settings how to use cifrex filters are based on regular expressions describing given kind of mistake together with the resources like cwe identifiers owasp this enables you to reach a lexical definition at http cwe mitre org fast each filter is based on maximum of nine patterns regular expressions can be divided in three groups v value regular expression enabling retrieval of the sequences of signs and the attribution of retrieved values to the variable v1 v2 lub v3 for example the name of array char name 128 char v1 w d there is a possibility of using variables v1 v2 and v3 to search for sequences that are interesting to us it allows us to use found values in the patterns of type t truth and f false t truth regular expression which must be present in the code for example strcpy v1 f false regular expression which cannot be present in the code for example if null null each expression fulfils given roles the expressions of type v are used mainly to assign the variable names while the expression of type t and f are mainly used to precise their usage to put it simply patterns of type v are used to catch names of variables used in the unsuitable manner for example all arrays v1 of type char used in the function strcpy t1 without controlling the length through strlen f1 we will also need to specify directory what we wish to analyse it is possible to change default directory by setting default_directory in the code of cifrex which means the localization of the analyzed source code to speed up the search process we mark language which are interesting to us this allows the script to omit the unneeded files in the filtration process we can start scanning the files by pressing the button by using three types regular expressions we can create a filter which will be checked in all indicated files if all expressions will be fulfilled file will be shown in the search results this does not mean that it is susceptible to the given mistake the efficiency of the method can oscillate on the level several percent depending on the filter exactness more details in the regular expressions gives us the larger probability of finding the error let us analyse thoroughly after mentioned example it try find name and size of char table through the pattern v1 char v1 w v2 thanks to the application of variables v1 and v2 we can dynamically find the name of table and its size this can help us in the creation of succeeding regular expressions of type t and f in this case the expression of type t1 is strcpy v1 if in the given file will be found line with use of strcpy function and the name v1 condition will be fulfilled in contrast to the conditions of type f which are fulfilled in the situation when a given expression does not appear in the code for example use of array name v1 and the string null v1 null in one line if in the given file all the logic of the expressions will be fulfilled cifrex will inform us about this in this way it can be seen in the after mentioned example that cifrex helped us to find the use of function strcpy in the risky manner copying the indicator f2 to the board f2copy 1000 without controlling its length can show in the large degree the appearance of mistake cifrex does not state that the error has occurred but only helps in finding the risky programmers behaviours another example of cifrex use is the search of dangerous use of function malloc realloc or calloc as we know each of these functions when lacking the possibility of the allocation of a given data block returns null if we do not control returned values we can cause null pointer dereference error to occur search results example of bad usage of the alloc functions there are many other ways to use cifrex the more detailed is the regular expression the more accurate are the search results remember cifrex helps to search for the mistakes the search results does not guarantee the appearance of the susceptibilities the more exact the regular expression the larger probability of the appearance of the susceptibilities download version 5 x 02 10 2018 5 0 cifrex release download version 4 x 21 09 2017 4 3 cifrex release download 19 09 2017 4 2 cifrex release download 25 04 2017 4 1 cifrex release download version 3 x download codeplex section git master git clone https github com maksymiliana cifrex git common weakness enumeration cwe cifrex is entirely compatible with the cwe program this means that each official filter is equipped with cwe key signature enabling to reach the information about the kind of mistake and the examples of occurrence in other software cxsecurity is in possession of cwe certificate for the product world laboratory of bugtraq 2 therefore we also encourage to use our dictionary accessible under the address https cxsecurity com allcwe continually we try to be kept the high standard of our wlb2 database and not only we encourage to visit the official cwe site http cwe mitre org cifrex cve cwe support search cve or cwe on cxsecurity com history the idea of program originated in 2010 during the analysis of the code of the library libc of netbsd system during the routine use of regular expressions in grep program find name c xargs grep e i have come upon the idea of optimizing the use of regular expressions in the analysis of the code thanks to which in several days the first beta version of the cifrex script originated working with maximum six of regular expressions after some time i improved the product in order to improve its efficiency at the beginning of 2011 the first version of the script with maximum nine regular expressions patterns has been created from that moment program began to help me in research effects can be seen on https cxsecurity com research_list for example the mistakes of null pointer dereference type in php has been caught with cifrex php 5 3 6 multiple null pointer dereference https cxsecurity com research 101 program helped also in the finding many mistakes in recurrence which on the detailed analyse proved the susceptibilities of resource exhaustion type in the function fnmatch in the c library systems from the bsd family this was shifted on the remote possibility of the suspension of apache server mod_autoindex multiple vendors libc fnmatch 3 dos incl apache https cxsecurity com research 98 or a similar error in vsftpd 2 3 2 demon vsftpd 2 3 2 remote denial of service https cxsecurity com research 95 they are not this all susceptibility which i found with help cifrex however in the course of time i have decided to make the script available to public in 2012 with the hope that this tool will be useful in the search of mistakes or at least will convince other that the knowledge of regular expressions pays off let us remember however that filters does not guarantee us the findings of mistake but they help us to do it let us not rely on the large effects without hard work since 20 october 2013 cifrex version 2 0 is available kacper rybczynski has joined to cifrex team he has developed and kick off version 2 0 to release version 1 2012 2013 version 2 2013 version 3 2015 version 4 2017 authors maksymilian arciemowicz kacper rybczynski grzegorz terlikowski license â center cifrex is completely free you can use copy and modify it on the base of bsdv2 license remember that you can modify this software and you can become an author of cifrex by translating it to other language than php version 1 and 2 copyright c 2017 cifrex team all rights reserved redistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and or other materials provided with the distribution neither the name of the cxsecurity nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission this software is provided by cifrex team as is and any express or implied warranties including but not limited to the implied warranties of merchantability and fitness for a particular purpose are disclaimed in no event shall maksymilian arciemowicz and kacper rybczynski liable for any direct indirect incidental special exemplary or consequential damages including but not limited to procurement of substitute goods or services loss of use data or profits or business interruption however caused and on any theory of liability whether in contract strict liability or tort including negligence or otherwise arising in any way out of the use of this software even if advised of the possibility of such damage version 1 and 2 version 3 cifrex tool for static code analysis copyright c 2017 cifrex team this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 3 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details you should have received a copy of the gnu general public license along with this program if not see http www gnu org licenses version 3 cifrex team 2012 2017