Updates RIPS v-0.5.5 - A static source code analyser for vulnerabilities in PHP scripts

Updates RIPS v-0.5.5 – A static source code analyser for vulnerabilities in PHP scripts

– updated configuration (sources, sinks, sanitization)
– added session fixation detection
– seperated reflection injection from code injection
– changed defaults (subdirs, vuln type)
– referenced user survey

RIPS is a tool written in PHP to find vulnerabilities in PHP applications using static code analysis. By tokenizing and parsing all source code files RIPS is able to transform PHP source code into a program model and to detect sensitive sinks (potentially vulnerable functions) that can be tainted by userinput (influenced by a malicious user) during the program flow. Besides the structured output of found vulnerabilities RIPS also offers an integrated code audit framework for further manual analysis.


  • vulnerabilities
  • Code Execution
  • Command Execution
  • Cross-Site Scripting
  • Header Injection
  • File Disclosure
  • File Inclusion
  • File Manipulation
  • LDAP Injection
  • SQL Injection
  • Unserialize with POP
  • XPath Injection
  • … other

code audit interface

  • scan and vulnerability statistics
  • grouped vulnerable code lines (bottom up or top down)
  • vulnerability description with example code, PoC, patch
  • exploit creator
  • file list and graph (connected by includes)
  • function list and graph (connected by calls)
  • userinput list (application parameters)
  • source code viewer with highlighting
  • active jumping between function calls
  • search through code by regular expression
  • 8 syntax highlighting designs
  • … much more

static code analysis

  • fast
  • tokenizing with PHP tokenizer extension
  • taint analysis for 232 sensitive sinks
  • inter- and intraprocedural analysis
  • handles very PHP-specific behaviour
  • handles user-defined securing
  • reconstruct file inclusions
  • detect blind/non-blind exploitation
  • detect backdoors
  • 5 verbosity levels
  • over 100 testcases

+ web server: Apache or Nginx recommended
+ PHP: latest version recommended
+ browser: Firefox recommended

+ Download the latest release
+ Extract the files to your local web server’s document root
+ Make sure your web server has file permissions
+ Make sure your installation is protected from unauthorized access
+ Open your browser at http://localhost/rips-xx/
Download : v0.55.zip  | v0.55.tar.gz
Source : https://github.com/ripsscanner | Our Post Before