RIPS - Tool For Detecting Vulnerabilities in PHP Applications

RIPS is a static code analyser that can detect vulnerabilities in PHP applications.

By tokenizing and parsing all source code files, it is able to transform PHP source code into a program model and to detect sensitive sinks (potentially vulnerable functions) that can be tainted by user-input (influenced by a malicious user) during the program flow. Besides the structured output of found vulnerabilities, RIPS offers an integrated code audit framework.

All detected security issues are available in real-time when your application is scanned. You can follow the current risk assessment of your application and directly begin to review the first issues - even if the scan is not complete yet.

It also provides a real-time heatmap during security analysis. It pinpoints an approximation of the overall security status of the analyzed application based on the number of vulnerabilities found and their severity.

For each detected security vulnerability, detailed information about the type of vulnerability in general, as well as the specific occurrence is given. RIPS explains the root cause of the issue and what impact a successful attack can cause. References to industry standards allow to quickly categorize each issue and to find further information.

Additionally, RIPS offers a detailed guide to the solution - even for unexperienced developers. This provides users with reliable information at hand in order to quickly resolve the problem without the need for further research.

When investigating a detected issue, you can update the review status of each vulnerability and add a comment. This helps to prioritize issues and to manage the workflow within your team.

For example, already patched issues can be marked as fixed or currently investigated issues can be marked as in progress in order to avoid duplicate work.

Different audit teams with customized user privileges can be created. You can decide which user is allowed to initiate a new scans of an application and who can see and review which analysis results.

RIPS analyzes all provided source code without the need of any additional configuration. Optionally, RIPS can be tailored to custom application specifics with comprehensive analysis settings. These include the manual definition of sources, sinks, sanitizers and validators in order to fine-tune the analysis precision.

Depending on PHP's configuration and version, subtle vulnerabilities can occur or are not exploitable. With RIPS it is further possible to specify PHP related settings such as magic_quotes_gpc, register_globals, and the PHP version itself. The RIPS analysis engine is aware of these subtlenesses and acts according to your exact production environment.