GrepBugs

all greps...

ASP

xss cross-site scripting cwe-79

Response.Write$[^$]*?(\+*|\&*)\s*Request.Params.Get$.*$(\+*|\&*)\s*

xss cross-site scripting cwe-79

input.*type=(\"|\')?hidden.*=.*Request\.(QUERYSTRING|FORM)

sql injection

sql.*=.*\"\s*\&

sql injection

CommandText\s*=\s*.*\"\s*\&

sql injection

\.Execute\(.*\"\s*\&

file information_leak

OpenTextFile\s?\(\s?Request\.

ASP.Net

xss, net

\.Append\(.*HttpContext\.Current\.Request\.Url

xss cross-site scripting cwe-79

\.(Append|WriteLine)$[^$]*?HttpContext\.Current\.Request\.(Url|Form|QueryString)

xss

\.Append\(.*HttpContext\.Current\.Request\.Form

xss

\.Append\(.*HttpContext\.Current\.Request\.QueryString

xss

\.WriteLine\(.*HttpContext\.Current\.Request\.Url

xss

\.WriteLine\(.*HttpContext\.Current\.Request\.Form

xss

\.WriteLine\(.*HttpContext\.Current\.Request\.QueryString

stack trace

response\.write\s*\(.*StackTrace

insecure certificate validation cwe-295

ServerCertificateValidationCallback\s*?\=

input request validation

<%@\s?Page\s?.*\s?validateRequest\s?=\s?(\'|\")false(\'|\")

uncontrolled format string cwe-134

race condition cwe-362 cwe-20

readlink\s?\(

race condition cwe-362

chown\s?\(|chgrp\s?\(|chmod\s?\(|readlink\s?\(

overflow buffer cat string concatenation cwe-120

lstrcat\s?\(|wcscat\s?\(|_tcscat\s?\(|_mbscat\s?\(

logic bug

if\s?$\s?.*\s?(?<!\!)(?<!=)(?<!<)(?<!>)=(?!=)\s?('|").*('|")\s?$

integer overflow

ALLOC[A-Z0-9_]*\s*$[Ë†,]*,[Ë†;]*[*+-][Ë†>][Ë†;]*$\s*;

insecure weak random entropy

input validation

recv\s?\(|recvfrom\s?\(|recvmsg\s?\(|fread\s?\(|readv\s?\(

errno error

if\s?\(\s?errno\s?=\s?E|if\s?\(\s?E[A-Za-z]*\s?=\s?errno

dangerous command execution functions

(system|popen)\s?\(

banned vararg variable argument sprintf cwe-120

banned string tokenizing

strtok\s?\(|_tcstok\s?\(|wcstok\s?\(|_mbstok\s?\(

banned string length

banned string copy cwe-120

banned scanf copy cwe-120 cwe-20

banned path

banned oem

banned numeric

banned n string cwe-120

banned memory copy overflow buffer

memcpy\s?\(|CopyMemory\s?\(|bcopy\s?\(|RtlCopyMemory\s?\(

banned memory alloc

alloca\s?\(|_alloca\s?\(

banned isbad

banned gets cwe-120 cwe-20

(\=|\(|\s)gets\s?\(|_getts\s?\(|_gettws\s?\(

banned deprecated getlogin

getlogin$.*$

warnings disable

#pragma\s+warning\s*\(\s*disable\s*:

sql injection cwe-89

\"\s*[Ss][Ee][Ll][Ee][Cc][Tt][^"]*"\s*\+\s*\w[^+]*\+\s*\"

insecure weak random entropy

Rnd\s?\(|Random\s?\(

insecure certificate validation cwe-295

X509CertificateValidationMode\.None|X509CertificateValidator\.None

ecb weak encryption mode

CipherMode.ECB

C++

uncontrolled format string cwe-134

race condition cwe-362 cwe-20

readlink\s?\(

race condition cwe-362

chown\s?\(|chgrp\s?\(|chmod\s?\(|readlink\s?\(

overflow buffer cat string concatenation

lstrcat\s?\(|wcscat\s?\(|_tcscat\s?\(|_mbscat\s?\(

logic bug

if\s?$\s?.*\s?(?<!\!)(?<!=)(?<!<)(?<!>)=(?!=)\s?('|").*('|")\s?$

insecure weak random entropy

input validation

recv\s?\(|recvfrom\s?\(|recvmsg\s?\(|fread\s?\(|readv\s?\(

executable load injection

CreateProcess\s?\(\s?NULL\s?,

errno error

if\s?\(\s?errno\s?=\s?E|if\s?\(\s?E[A-Za-z]*\s?=\s?errno

banned vararg variable argument sprintf cwe-120

banned string tokenizing

strtok\s?\(|_tcstok\s?\(|wcstok\s?\(|_mbstok\s?\(

banned string length

banned string copy cwe-120

banned scanf copy cwe-120 cwe-20

banned n string cwe-120

banned memory copy overflow buffer

memcpy\s?\(|CopyMemory\s?\(|bcopy\s?\(|RtlCopyMemory\s?\(

banned gets cwe-120 cwe-20

gets\s?\(|_getts\s?\(|_gettws\s?\(

banned deprecated getlogin

getlogin$.*$

ColdFusion

xss cross-site scripting cwe-79

( =\s.*|\<input ).*value=\s?(\"|\')\#(url|form)\.

xss

<input .*value=\"\#(url|form)

xss

=\s*\'\#(url|form)\..*\#\';

sql injection

cfx_ingres .*\"\s*select .*from .*\'?#(form|url)\.

sql injection

cfx_ingres .*\"\s*delete .*from .*\'?#(form|url)\.

sql injection

cfx_ingres .*\"\s*insert into .*\'?#(form|url)\.

sql injection

cfx_ingres .*\"\s*update .* set .*\'?#(form|url)\.

deprecated obsolete functions cwe-477

deprecated obsolete attributes cwe-477

deprecated obsolete attribute values cwe-477

debug information_leak

\<cfdump

command injection exec

\<cfexecute

ERB

xss, jquery, javascript

HTML

xss, jquery, javascript

hidden

<input.*\'?\"?hidden\'?\"?

Java

web http request input validation

getParameterNames\s?\(|getParameter\s?\(|getParameterValues\s?\(|getParamaterMap\s?\(

weak hash algorithm

\.getInstance\s?\(\s?\"(MD5|SHA-1)\"

unsafe file access vert.x

response\.sendFIle\s?$|response\s?\(\s?$\.sendFile\s?\(

stack trace

printStackTrace\s?\(

session request input validation

session\.setAttribute\(\".*\",\s*req(uest)?\.getParameter\(

resource executable access

openOrCreateDatabase\s?\(

resource executable access

getIntent\s\(

log logger sensitive information

load library

System\.loadLibrary\(

insecure weak random entropy

java\.util\.Random

insecure certificate validation cwe-295

X509Certificate\[\s?\]\s*getAcceptedIssuers$\s?$

ecb weak encryption mode

Cipher....Instance\s?\(\s?\".*ECB

des weak encryption algorithm

Cipher.newInstance\s?\(\s?\"DES|Cipher.getInstance\s?\(\s?\"DES

command runtime exec

getRuntime\s?\(

buffer overflow unsafe cwe-120

sun\.misc\.Unsafe

Javascript

xss, jquery, javascript

web sockets

ws:\/\/

privacy geolocation

navigator.geolocation.getCurrentPosition

postmessage html5

\.postMessage\s?$.*\,.*\*.*$

logic bug

if\s?$\s?.*\s?(?<!\!)(?<!=)(?<!<)(?<!>)=(?!=)\s?('|").*('|")\s?$

location sink

location\.replace

local storage data

localStorage\.

insecure weak random entropy

inner html sink

eval sink

document write sink

JSP

xss cross-site scripting cwe-79

\<\%(\s*print|=)\s*request\.get(Parameter|QueryString)\s?\(

xss cross-site scripting cwe-79

out\.println\s*\(\s*request\.get(Parameter|QueryString)\s*\(\s*\"

xss cross-site scripting cwe-79

input.*type=(\"|\')?hidden.*=.*request\.get(Parameter|QueryString)

xss

\<\%=\s*request\.get(?!(Parameter|QueryString)).*\(

xss

\<\%=\s*request\.getParameter\(

xss

\<\%=\s*request\.getQueryString\(

xss

\<\%=\s*request\.(getParameter|getQueryString)\s*\(

weak hash algorithm

\.getInstance\s?\(\s?\"(MD5|SHA-1)\"

stack trace

\.printStackTrace\s?\(

local file inclusion

<jsp:include[^>]*request\.

local file include

(\%\@include[^>]*file\=.*\<\%\=.*|<jsp:include[^>]*)request\.

header injection

\.addHeader\s?\(\s?(\'|\").*(\'|\")\s?,

Objective C

weak hash md5

CC_MD5\s?\(

uuid privacy deprecated

uniqueGlobalDeviceIdentifier

script injection

stringByEvaluatingJavaScriptFromString

log data

NSLog\s?\(

insecure certificate validation cwe-295

AnyHTTPSCertificate

file information_leak injection

\[.*\ writeToFile\s?\:.*\]

cookie session data

\sdateByAddingTimeInterval\s?\:.*\sforKey\s?\:\s?NSHTTPCookieExpires

PHP

xss multiple sinks

xss cross-site scripting cwe-79

xss cross-site scripting cwe-79

\.\=.*?\s*\$_((POST|GET)\[.*?\]|SERVER\[.?(REQUEST_URI|QUERY_STRING))

weak hash

md5\s?\(

weak encryption algorithm

CRYPT_STD_DES|CRYPT_EXT_DES|CRYPT_MD5

sql injection cwe-89

\"\ *(S|s)(E|e)(L|l)(E|e)(C|c)(T|t)[^"]*"\ *\.\ *\w[^.]*\.\ *\"

sql injection cwe-89

preg evaluate code

preg_replace\s?\(

obsolete,unsupported

object injection cwe-94

unserialize\s?\(

logic bug

if\s?$\s?.*\s?(?<!\!)(?<!=)(?<!<)(?<!>)=(?!=)\s?('|").*('|")\s?$

insecure weak random

mt_rand\s?\(|srand\s?\(

insecure weak random

uniqid\s?\(

information_leak info

phpinfo\s?\(|show_source\s?\(|highlight_file\s?\(

header injection

[^a-zA-Z_]header\s?(\(|'|\"|$).+\$.+

header injection

_SERVER\[\s*('|")HTTP_HOST('|")\s*\]

file include require

require\s?(\(|'|\"|$).*\\$.*$

file include require

require_once\s?(\(|'|\"|$).*\\$.*$

file include

include\s?(\(|'|\"|$).*\\$.*$

file include

include_once\s?(\(|'|\"|$).*\\$.*$

depricated function encryption

mcrypt_cbc\s?\(|mcrypt_cfb\s?\(|mcrypt_ecb\s?\(|mcrypt_ofb\s?\(|mcrypt_encrypt\s?\(

depricated function encryption

mcrypt_generic_end\s?\(