Sobelow v0.6.1 Mix.Tasks.Sobelow
Sobelow is a static analysis tool for discovering vulnerabilities in Phoenix applications.
This tool should be run in the root of the project directory with the following command:
mix sobelow
Command line options
--root -r
- Specify application root directory--with-code -v
- Print vulnerable code snippets--ignore -i
- Ignore modules--ignore-files
- Ignore files--details -d
- Get module details--all-details
- Get all module details--private
- Skip update checks--skip
- Skip functions flagged with@sobelow_skip
--router
- Specify router location--exit
- Return non-zero exit status--format
- Specify findings output format--quiet
- Return no output if there are no findings--compact
- Minimal, single-line findings
Ignoring modules
If specific modules, or classes of modules are not relevant to the scan, it is possible to ignore them with a comma-separated list.
mix sobelow -i XSS.Raw,Traversal
Supported modules
- XSS
- XSS.Raw
- XSS.SendResp
- XSS.ContentType
- SQL
- SQL.Query
- SQL.Stream
- Config
- Config.CSRF
- Config.Headers
- Config.HTTPS
- Config.HSTS
- Config.Secrets
- Vuln
- Vuln.CookieRCE
- Vuln.HeaderInject
- Vuln.PlugNull
- Vuln.Redirect
- Vuln.Coherence
- Traversal
- Traversal.SendFile
- Traversal.FileModule
- Misc
- Misc.BinToTerm
- Misc.FilePath
- CI
- CI.System
- CI.OS
- DOS
- DOS.StringToAtom
- DOS.ListToAtom
- DOS.BinToAtom
Summary
Functions
A task needs to implement run
which receives
a list of command line args
Functions
A task needs to implement run
which receives
a list of command line args.
Callback implementation for Mix.Task.run/1
.