diff --git a/src/site/markdown/analyzers/index.md b/src/site/markdown/analyzers/index.md index 30dfb3a21..298c2cd22 100644 --- a/src/site/markdown/analyzers/index.md +++ b/src/site/markdown/analyzers/index.md @@ -3,12 +3,14 @@ File Type Analyzers OWASP dependency-check contains several file type analyzers that are used to extract identification information from the files analyzed. -- [Archive Analyzer](./archive-analyzer.html) -- [Assembly Analyzer](./assembly-analyzer.html) -- [Autoconf Analyzer](./autoconf-analyzer.html) -- [Central Analyzer](./central-analyzer.html) -- [Jar Analyzer](./jar-analyzer.html) -- [Nexus Analyzer](./nexus-analyzer.html) -- [Nuspec Analyzer](./nuspec-analyzer.html) -- [OpenSSL Analyzer](./openssl-analyzer.html) -- [Python Analyzer](./python-analyzer.html) +| Analyzer | File Types Scanned | Analysis Method | +| -------- | ------------------ | --------------- | +| [Archive Analyzer](./archive-analyzer.html) | Zip archive format (\*.zip, \*.ear, \*.war, \*.jar, \*.sar, \*.apk, \*.nupkg); Tape Archive Format (\*.tar); Gzip format (\*.gz, \*.tgz); Bzip2 format (\*.bz2, \*.tbz2) | Extracts archive contents, then scans contents with all available analyzers. | +| [Assembly Analyzer](./assembly-analyzer.html) | .NET Assemblies (\*.exe, \*.dll) | Uses [GrokAssembly.exe](https://github.com/colezlaw/GrokAssembly), which requires .NET Framework or Mono runtime to be installed. | +| [Autoconf Analyzer](./autoconf-analyzer.html) | Autoconf project configuration files (configure, configure.in, configure.ac) | Regex scan for AC_INIT metadata, including in generated configuration script. | +| [Central Analyzer](./central-analyzer.html) | Java archive files (\*.jar) | Searches Maven Central or a configured Nexus repository for the file's SHA1 hash. | +| [Jar Analyzer](./jar-analyzer.html) | Java archive files (\*.jar); Web application archive (\*.war) | Examines archive manifest metadata, and Maven Project Object Model files (pom.xml). | +| [Nexus Analyzer](./nexus-analyzer.html) | Java archive files (\*.jar) | Searches Sonatype or a configured Nexus repository for the file's SHA1 hash. In most cases, superceded by Central Analyzer. | +| [Nuspec Analyzer](./nuspec-analyzer.html) | Nuget package specification file (\*.nuspec) | Uses XPath to parse specification XML. | +| [OpenSSL Analyzer](./openssl-analyzer.html) | OpenSSL Version Source Header File (opensslv.h) | Regex parse of the OPENSSL_VERSION_NUMBER macro definition. | +| [Python Analyzer](./python-analyzer.html) | Python source files (\*.py); Package metadata files (PKG-INFO, METADATA); Package Distribution Files (\*.whl, \*.egg, \*.zip) | Regex scan of Python source files for setuptools metadata; Parse RFC822 header format for metadata in all other artifacts. | diff --git a/src/site/markdown/general/scan_iso.md b/src/site/markdown/general/scan_iso.md new file mode 100644 index 000000000..66e3c03a7 --- /dev/null +++ b/src/site/markdown/general/scan_iso.md @@ -0,0 +1,122 @@ +How to Mount ISO Files for Scanning +=================================== + +Dependency-Check can be used as one of your tools for vetting software +distributed via an [ISO image](https://en.wikipedia.org/wiki/ISO_image). (See +[File Type Analyzers](../analyzers/) for a list of what types of artifacts +Dependency-Check is capable of scanning.) These disk image files are not a standard archive format, however. Tools must be used that can interpret the contained file system. As will be shown below, Linux, Mac OS X, and recent versions of Windows can be used to mount the image's file system, which can +then be scanned by Dependency-Check. + +ISO images are named for the fact that they nearly always contain one of a +pair of international file system standards published by +[ISO](http://www.iso.org/): [ISO 9660](https://en.wikipedia.org/wiki/ISO_9660) +and ISO/IEC 13346, a.k.a. [UDF](https://en.wikipedia.org/wiki/Universal_Disk_Format). Other types of disk images (e.g., +[VHD](https://en.wikipedia.org/wiki/VHD_%28file_format%29)) are outside the +scope of this article, though the ideas presented here may likely be +succesfully applied. + +Linux +----- + +Assume you've downloaded an ISO image called `foo.iso`, and you want to mount +it at /mnt/foo. (Why /mnt? See the +[Filesystem Hierarchy Standard](http://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch03s12.html).) +First make sure that the mount point exists using `mkdir /mnt/foo`. Then, the +[mount](http://linux.die.net/man/8/mount) command *must be run with root +privileges*. On Debian and Ubuntu Linux, this is accomplished by prefacing the +command with `sudo`. + +```sh +$ sudo mount -o loop foo.iso /mnt/foo +``` + +Next, you can use Dependency-Check's [command line tool](dependency-check-cli/) +to scan the mount point. When you are finished, run the +[umount](http://linux.die.net/man/8/umount) command with root privileges: + +```sh +$ sudo umount -d /mnt/foo +``` + +This will unmount the file system, and detach the loop device. + +Mac OS X +-------- + +### Using the GUI + +Simply double-click on the image file in Mac OS X Finder. + +### Using a Terminal Window + +Use the [hdiutil](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/hdiutil.1.html) +command. + +```sh +$ hdiutil attach foo.iso +``` + +The output will show the `/dev` entry assigned as well as the mount point, +which is where you may now read the files in the image's file system. + +To detach: + +```sh +$ hdiutil detach foo.iso +``` + +Windows +------- + +Windows 8 and later versions support mounting ISO images as a virtual drive. + +### Using the GUI + +1. In *File Explorer*, right-click on "foo.iso". +2. Select "Mount" + +File Explorer then redirects to showing the files on your virtual drive. You can then use the [command line tool](dependency-check-cli/) to scan the +virtual drive. When finished, "Windows-E" will open File Explorer showing the various drives on your computer. To eject the virtual drive: + +1. Right-click on the virtual drive. +2. Select "Eject" + +### Using PowerShell + +To mount, use the [Mount-DiskImage](https://technet.microsoft.com/en-us/%5Clibrary/Hh848706%28v=WPS.630%29.aspx) +cmdlet: + +```posh +$ Mount-DiskImage -ImagePath C:\Full\Path\to\foo.iso +``` + +To view all drives (and find your virtual drive), use the +[Get-PSDrive](https://technet.microsoft.com/en-us/library/Hh849796.aspx) +cmdlet: + +```posh +$ Get-PSDrive -PSProvider 'FileSystem' +``` + +To dismount, use the [Dismount-DiskImage](https://technet.microsoft.com/en-us/library/hh848693%28v=wps.630%29.aspx) +cmdlet: + +```posh +$ Dismount-DiskImage -ImagePath C:\Full\Path\to\file.iso +``` + +### Windows 7 + +Third-party tools exist that can be used to mount ISO images. Without such +tools, it is still possible to burn the ISO image to physical media, and scan +the media: + +1. Right-click on "foo.iso" +2. Select "Windows Disc Image Burner" +3. Follow the instructions to burn the image. + +### Windows Vista + +Just as with Windows 7, you will need a third-party tool to mount an ISO +image. You will also need a third-party tool to burn the image to media. +Many machines are shipped with such a tool included. \ No newline at end of file diff --git a/src/site/site.xml b/src/site/site.xml index 6ca795342..314bf2cbf 100644 --- a/src/site/site.xml +++ b/src/site/site.xml @@ -102,31 +102,34 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. Sample Report + + How to Scan an ISO Image + Archive Analyzer - - Jar Analyzer + + Assembly Analyzer - - Python Analyzer + + Autoconf Analyzer Central Analyzer + + Jar Analyzer + Nexus Analyzer - - Assembly Analyzer - Nuspec Analyzer - - Autoconf Analyzer + + Python Analyzer OpenSSL Analyzer