# Grepmarx | A Source Code Static Analysis Platform For AppSec Enthusiasts **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, hacking, freebies\ **Created:** [April 6, 2023, 1:32pm UTC](https://onehack.st/t/grepmarx-a-source-code-static-analysis-platform-for-appsec-enthusiasts/236110 "2023-04-06T13:32:52Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\ **Post date:** [April 6, 2023, 1:32pm UTC](https://onehack.st/t/grepmarx-a-source-code-static-analysis-platform-for-appsec-enthusiasts/236110/1 "2023-04-06T13:32:53Z")
[![Grepmarx](https://github.com/Orange-Cyberdefense/grepmarx/raw/main/media/grepmarx-logo.png)](https://github.com/Orange-Cyberdefense/grepmarx/blob/main/media/grepmarx-logo.png) # Grepmarx - Application Security Platform Grepmarx is a web application providing a single platform to quickly understand, analyze and identify vulnerabilities in possibly large and unknown code bases. ## Features SAST (Static Analysis Security Testing) capabilities: - Multiple languages support: C/C++, C#, Go, HTML, Java, Kotlin, JavaScript, TypeScript, OCaml, PHP, Python, Ruby, Bash, Rust, Scala, Solidity, Terraform, Swift - Multiple frameworks support: Spring, Laravel, Symfony, Django, Flask, Node.js, jQuery, Express, Angular… - 1600+ existing analysis rules - Easily extend analysis rules using Semgrep syntax: [https://semgrep.dev/editor](https://semgrep.dev/editor) - Manage rules in rule packs to tailor code scanning SCA (Software Composition Analysis) capabilities: - Multiple package-dependency formats support: NPM, Maven, Gradle, Composer, pip, Gopkg, Gem, Cargo, NuPkg, CSProj, PubSpec, Cabal, Mix, Conan, Clojure, Docker, GitHub Actions, Jenkins HPI, Kubernetes - SBOM (Software Bill-of-Materials) generation (CycloneDX compliant) Extra - Analysis workbench designed to efficiently browse scan results - Scan code that doesn’t compile - Comprehensive LOC (Lines of Code) counter - Inspector: automatic application features discovery - … and a Dark Mode ## Screenshots | Scan customization | Analysis workbench | Rule pack edition | | --- | --- | --- | | [![Scan customization](https://github.com/Orange-Cyberdefense/grepmarx/raw/main/media/screen-1.png)](https://github.com/Orange-Cyberdefense/grepmarx/blob/main/media/screen-1.png) | [![Analysis workbench](https://github.com/Orange-Cyberdefense/grepmarx/raw/main/media/screen-2.png)](https://github.com/Orange-Cyberdefense/grepmarx/blob/main/media/screen-2.png) | [![Rule pack edition](https://github.com/Orange-Cyberdefense/grepmarx/raw/main/media/screen-3.png)](https://github.com/Orange-Cyberdefense/grepmarx/blob/main/media/screen-3.png) | ## Execution Grepmarx is provided with a configuration to be executed in [Docker](https://www.docker.com/) and [Gunicorn](https://gunicorn.org/). #### [Docker](https://www.docker.com/) execution * * * Make sure you have docker-composer installed on the system, and the docker daemon is running. The application can then be easily executed in a docker container. The steps: > Get the code $ git clone [https://github.com/Orange-Cyberdefense/grepmarx.git](https://github.com/Orange-Cyberdefense/grepmarx.git) $ cd grepmarx > Start the app in Docker $ sudo docker-compose pull && sudo docker-compose build && sudo docker-compose up -d Visit `http://localhost:5000` in your browser. The app should be up & running. **Note: a default user account is created on first launch (user=admin / password=admin). Change the default password immediately.** #### [Gunicorn](https://gunicorn.org/) * * * Gunicorn ‘Green Unicorn’ is a Python WSGI HTTP Server for UNIX. A supervisor configuration file is provided to start it along with the required Celery worker (used for security scans queuing). > Install using pip $ pip install gunicorn supervisor > Start the app using gunicorn binary $ supervisord -c supervisord.conf Visit `http://localhost:8001` in your browser. The app should be up & running. **Note: a default user account is created on first launch (user=admin / password=admin). Change the default password immediately.** ## Build from sources > Get the code $ git clone [https://github.com/Orange-Cyberdefense/grepmarx.git](https://github.com/Orange-Cyberdefense/grepmarx.git) $ cd grepmarx > Install virtualenv modules $ virtualenv env $ source env/bin/activate > Install Python modules $ # SQLite Database (Development) $ pip3 install -r requirements.txt $ # OR with PostgreSQL connector (Production) $ # pip install -r requirements-pgsql.txt > Install additionnal requirements # Dependency scan (cdxgen / depscan) requirements $ sudo apt install npm openjdk-17-jdk maven gradle golang composer $ sudo npm install -g @cyclonedx/cdxgen $ pip install appthreat-depscan > A Redis server is required to queue security scans. Install the `redis` package with your favorite distro package manager, then: $ redis-server > Set the FLASK\_APP environment variable $ export FLASK\_APP=run.py $ # Set up the DEBUG environment $ # export FLASK\_ENV=development > Start the celery worker process $ celery -A app.celery\_worker.celery worker --pool=prefork --loglevel=info --detach > Start the application (development mode) $ # --host=0.0.0.0 - expose the app on all network interfaces (default 127.0.0.1) $ # --port=5000 - specify the app port (default 5000) $ flask run --host=0.0.0.0 --port=5000 > Access grepmarx in browser: [http://127.0.0.1:5000/](http://127.0.0.1:5000/) **Note: a default user account is created on first launch (user=admin / password=admin). Change the default password immediately.** ## Credits & Links - The web application dashboard is based on [AdminLTE Flask](https://github.com/app-generator/flask-dashboard-adminlte) - SAST code scanning is powered by the [semgrep](https://semgrep.dev/) engine - SBOM generation is done with the great [CycloneDX cdxgen](https://github.com/CycloneDX/cdxgen), and SCA is performed using the awesome [AppThreat dep-scan](https://github.com/AppThreat/dep-scan) - LOC counting is handled by [scc](https://github.com/boyter/scc) - Features discovery is done using A[pplication Inspector](https://github.com/microsoft/ApplicationInspector) ## GitHub: [https://github.com/Orange-Cyberdefense/grepmarx](https://github.com/Orange-Cyberdefense/grepmarx)