awesome-source-auditing

A curated list of source auditing resources.
https://github.com/initsecret/awesome-source-auditing

Last synced: about 11 hours ago
JSON representation

Manual Reference
- Cheatsheets
  - iSECPartners LibTech-Auditing-Cheatsheet - awesome checklist, albeit slightly outdated (I forked it with the intention of modernizing it, feel free to chime in with your thoughts [here](https://github.com/sgmenda/LibTech-Auditing-Cheatsheet/issues).)
  - Kudelski Security's Auditing code for crypto flaws: the first 30 minutes
  - Kudelski Security's Auditing Rust Crypto: The First Hours
  - Security assessment techniques for Go projects - awesome blog post, so good that this is the only Go resource on this page!
- Best Practices
  - veorq's Cryptocoding - the definitive source cryptocoding recommendations.
  - Pornin's Constant-Time Crypto - the definitive source for constant-time crypto.
- Vulnerability Lists
Automation
- Automated Searching
  - Sourcetrail - source explorer that makes it easy to understand and navigate large code bases.
  - Joern - looks like an open-source alternative to CodeQL (I haven't had a chance to play with it yet).
  - Joern - looks like an open-source alternative to CodeQL (I haven't had a chance to play with it yet).
  - Semgrep - static analysis tool that makes it really easy to search code.
  - CodeQL - static analysis tool that is much more powerful than semgrep, but also harder to use.
- Static Analysis Tools
  - cppcheck - simple static analysis tool for C/C++.
  - RATS - seems a outdated but you might still be able to get something out of it (I haven't even compiled it, so no warranties here.)
  - slither - the goto static analysis tool for solidity.
  - AddressSanitizer
  - MemorySanitizer
  - UndefinedBehaviorSanitizer
  - ThreadSanitizer
  - clang static analyzer - easy to use, and might be a good second step after the sanitizers.
  - Creating an LLVM Sanitizer from Hopes and Dreams - tutorial on how to write a new LLVM sanitizer.
- Simple Fuzzers
  - AFL - a standard no-frills fuzzing engine
  - libfuzzer - a standard no-frills fuzzing engine
  - Rust Fuzz Book - instructions on how to fuzz rust projects.
Thanks
- War Games / CTFs
  - dar5hak/generator-awesome-list
Introduction
- Guides
  - CTF Field Guide - Auditing Source Code - this was my first introduction to source auditing, I highly recommend watching the lectures.
  - OWASP Code Review Guide - this guide is quite large but it might be helpful to mentally index it and keep the link handy.
Practice
- War Games / CTFs
Other Awesome Lists
- War Games / CTFs
  - Awesome Security

Programming Languages

C 2 Scala 2 C++ 2 Python 2 OCaml 1 JavaScript 1

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

awesome-source-auditing

Manual Reference

Cheatsheets

Best Practices

Vulnerability Lists

Automation

Automated Searching

Static Analysis Tools

Simple Fuzzers

Thanks

War Games / CTFs

Introduction

Guides

Practice

War Games / CTFs

Other Awesome Lists

War Games / CTFs