Static analysis of Python web applications based on theoretical foundations (Control flow graphs, fixed point, dataflow analysis)

• Detect command injection, SSRF, SQL injection, XSS, directory traveral etc.
• A lot of customisation possible

For a look at recent changes, please see the changelog.

Example usage and output:

pip install python-taint

PyT can also be installed from source. To do so, clone the repo, and then run:

python3 setup.py install

usage: python -m pyt [-h] [-f FILEPATH] [-a ADAPTOR] [-pr PROJECT_ROOT]
                     [-b BASELINE_JSON_FILE] [-j] [-m BLACKBOX_MAPPING_FILE]
                     [-t TRIGGER_WORD_FILE] [-o OUTPUT_FILE] [-trim] [-i]

required arguments:
  -f FILEPATH, --filepath FILEPATH
                        Path to the file that should be analysed.

optional arguments:
  -a ADAPTOR, --adaptor ADAPTOR
                        Choose a web framework adaptor: Flask(Default),
                        Django, Every or Pylons
  -pr PROJECT_ROOT, --project-root PROJECT_ROOT
                        Add project root, only important when the entry file
                        is not at the root of the project.
  -b BASELINE_JSON_FILE, --baseline BASELINE_JSON_FILE
                        Path of a baseline report to compare against (only
                        JSON-formatted files are accepted)
  -j, --json            Prints JSON instead of report.
  -m BLACKBOX_MAPPING_FILE, --blackbox-mapping-file BLACKBOX_MAPPING_FILE
                        Input blackbox mapping file.
  -t TRIGGER_WORD_FILE, --trigger-word-file TRIGGER_WORD_FILE
                        Input file with a list of sources and sinks
  -o OUTPUT_FILE, --output OUTPUT_FILE
                        write report to filename

print arguments:
  -trim, --trim-reassigned-in
                        Trims the reassigned list to just the vulnerability
                        chain.
  -i, --interactive     Will ask you about each blackbox function call in
                        vulnerability chains.