{"id":35179843,"url":"https://github.com/angelej/php-insider","last_synced_at":"2026-04-06T04:32:29.892Z","repository":{"id":189332697,"uuid":"669627484","full_name":"angelej/php-insider","owner":"angelej","description":"A simple static application security testing (SAST) tool for locating dangerous sinks in php applications.","archived":false,"fork":false,"pushed_at":"2025-12-28T23:53:43.000Z","size":155,"stargazers_count":5,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-12-31T16:19:40.795Z","etag":null,"topics":["appsec","php","sast","security","static-code-analysis","whitebox"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/angelej.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-07-22T22:46:02.000Z","updated_at":"2025-12-28T23:53:46.000Z","dependencies_parsed_at":null,"dependency_job_id":"77be35da-b24a-4fbb-9656-d6d929409f0c","html_url":"https://github.com/angelej/php-insider","commit_stats":null,"previous_names":["angelej/php-insider"],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/angelej/php-insider","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/angelej%2Fphp-insider","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/angelej%2Fphp-insider/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/angelej%2Fphp-insider/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/angelej%2Fphp-insider/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/angelej","download_url":"https://codeload.github.com/angelej/php-insider/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/angelej%2Fphp-insider/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31460101,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-05T21:22:52.476Z","status":"online","status_checked_at":"2026-04-06T02:00:07.287Z","response_time":112,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["appsec","php","sast","security","static-code-analysis","whitebox"],"created_at":"2025-12-29T00:53:48.043Z","updated_at":"2026-04-06T04:32:29.886Z","avatar_url":"https://github.com/angelej.png","language":"PHP","readme":"# PHP-Insider\n[![Unit Tests](https://github.com/angelej/php-insider/actions/workflows/tests.yml/badge.svg)](https://github.com/angelej/php-insider/actions/workflows/tests.yml)\n\nPHP-Insider is a static application security testing tool (SAST), which is specialized in finding dangerous sinks.\nIt's not designed to be a fully-automated tool for identifying vulnerabilities, but rather an aid for analysts finding them.\n\n\u003e **Warning!** This repository is currently under development and may contain breaking changes.\n\n## Installation\nIf this tool is used without docker, you have to install `php ^8.4`, `ext-dom`, `ext-simplexml`, `ext-tokenizer`, `ext-xml`, `ext-xmlwriter`, and `composer`.\n1. Clone repository\n    ```shell\n    git clone https://github.com/angelej/php-insider.git\n    cd php-insider\n    ```\n2. Install dependencies\n    ```shell\n    composer install\n    ```\n\n## Basic Usage\n### Without using Docker\n```shell\ninsider@linux:~$ ./bin/insider analyse /path/to/app\n   ExecSink  found in file src/Command.php › Ⓒ Command › ⓜ execute \n        5▕     public function execute(string $cmd){\n        6▕ \n    ➜   7▕         return exec($cmd);\n        8▕     }\n        9▕ }\n\n\n   Summary:  1 sink found\n```\n\n### Using Docker\n```shell\ninsider@linux:~$ docker run --rm -it -v /path/to/app:/app angelej/php-insider:latest analyse /app/src\n   ExecSink  found in file src/Command.php › Ⓒ Command › ⓜ execute \n        5▕     public function execute(string $cmd){\n        6▕ \n    ➜   7▕         return exec($cmd);\n        8▕     }\n        9▕ }\n\n\n   Summary:  1 sink found\n```\n\n## Level\nThe level can be defined using the `-l|--level` command option.\nThe higher the level, the more selective the analysis.\n\n| Level              | Description                                |\n|:-------------------|:-------------------------------------------|\n| **0**  (_default_) | all supported sinks                        | \n| **1**              | sinks with dynamic variables               | \n\n## Supported Sinks\n### Code Execution\n- [`` `backtick` ``](https://www.php.net/manual/en/language.operators.execution)\n- [`eval()`](https://www.php.net/manual/en/function.eval)\n- [`exec()`](https://www.php.net/manual/en/function.exec)\n- [`passthru()`](https://www.php.net/manual/en/function.passthru)\n- [`pcntl_exec()`](https://www.php.net/manual/en/function.pcntl-exec)\n- [`popen()`](https://www.php.net/manual/en/function.popen)\n- [`proc_open()`](https://www.php.net/manual/en/function.proc-open)\n- [`shell_exec()`](https://www.php.net/manual/en/function.shell-exec)\n- [`system()`](https://www.php.net/manual/en/function.system)\n\n### File Inclusion\n- [`include()`](https://www.php.net/manual/en/function.include)\n- [`include_once()`](https://www.php.net/manual/en/function.include-once)\n- [`require()`](https://www.php.net/manual/en/function.require)\n- [`require_once()`](https://www.php.net/manual/en/function.require-once)\n\n### File Read\n- [`file_get_contents()`](https://www.php.net/manual/en/function.file-get-contents)\n- [`file()`](https://www.php.net/manual/en/function.file)\n- [`fread()`](https://www.php.net/manual/en/function.fread.php)\n- [`readfile()`](https://www.php.net/manual/en/function.readfile)\n\n### File Write\n- [`copy()`](https://www.php.net/manual/en/function.copy)\n- [`fwrite()`](https://www.php.net/manual/en/function.fwrite.php)\n- [`file_put_contents()`](https://www.php.net/manual/en/function.file-put-contents)\n- [`link()`](https://www.php.net/manual/en/function.link)\n- [`move_uploaded_file()`](https://www.php.net/manual/en/function.move-uploaded-file)\n- [`rename()`](https://www.php.net/manual/en/function.rename.php)\n- [`symlink()`](https://www.php.net/manual/en/function.symlink)\n\n### Information Disclosure\n- [`phpinfo()`](https://www.php.net/manual/en/function.phpinfo)\n\n### Others\n- [`putenv()`](https://www.php.net/manual/en/function.putenv.php)\n- [`fopen()`](https://www.php.net/manual/en/function.fopen.php)\n- [`unlink()`](https://www.php.net/manual/en/function.unlink.php)\n- [`class_exists()`](https://www.php.net/manual/en/function.class-exists.php)\n\n\u003cbr/\u003e\n\n## Testing\n```shell\ncomposer test\n```\n\n## Security Vulnerabilities\nIf you discovered a security vulnerability, please send an e-mail to [jeremy.angele@proton.me](mailto:jeremy.angele@proton.me). All security vulnerabilities will be promptly addressed.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fangelej%2Fphp-insider","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fangelej%2Fphp-insider","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fangelej%2Fphp-insider/lists"}