CAT.NET
CAT.NET is a static code analysis tool that helps identify some of the most common security flaws found within web applications: SQL injection, cross-scripting and other data injection bugs. It is able to scan compiled managed assemblies (C#, Visual Basic .NET, J#) and then analyze dataflow paths from sources of user-controlled input to vulnerable outputs. It also detects whether proper encoding or filtering has been applied to the data.
CAT.NET tool can be used as VS 2008 addin or from command prompt.
Vulnerabilities that CAT.NET look for?
• Process Command Execution
• File Canonicalization
• Exception Information
• LDAP Injection
• XPATH Injection
• SQL Injection
• Redirection to User Controlled Site
• Cross-Site scripting
How to use CAT.NET?
1.Have your Asp.NET application and build the application.
2. The open the command prompt in administrator mode.
Type the following command
catnetcmd /file:"dll location" /configdir: "dir location" :/report:"simple.xml"
3. Open the output xml file.
From this we can get the information about the vulnerabilities.
We can use the following command line options
/file:<target>
Required. The path of an assembly file to analyze. Multiple file paths and wildcards are not supported. This is a required parameter.
/configdir:<target directory>
Required. The path to a directory which contains .NET configuration files for analysis.
/rules:<directory>
Optional. The path to a file or directory that contains analysis rule(s). The engine will use the default rules included with the product by default.
/report:<file>
Optional. The file to store the analysis report in. By default, the report will be saved in ‘MicrosoftCodeAnalysisReport.xml’ in the current working directory.
/reportxsl:<file>
Optional. The XSL file to use to transform the report. By default, the packaged XSL transform included in the product will be used.
/reportxsloutput:<file>
Optional. The output file to store the XSLT transform output in. By default, the HTML report will be saved in ‘report.html’ in the current working directory.
/verbose
Optional. Enables flag to display verbose message when displaying results
-
-
img cat net
-
-
img cat netresult