- Should I use it on daily bases to test my WordPress plugins and themes?
- Should I use it also to test other WordPress plugins and themes?
Yes, and yes, RIPS is an excellent tool to do both.
You can use it to check the quality of your WordPress themes and plugins or any other WordPress theme and plugin.
RIPS is a static code analysis tool to automatically detect vulnerabilities in PHP applications. By tokenizing and parsing all source code files RIPS is able to transform PHP source code into a program model and to detect sensitive sinks (potentially vulnerable functions) that can be tainted by user input (influenced by a malicious user) during the program flow. Besides the structured output of found vulnerabilities RIPS also offers an integrated code audit framework for further manual analysis.
Here is how it works simplified.
This usage would not be smart and RIPS will detect the possible flows
$h = fopen( $_GET['file'], 'w' ); fwrite( $h, $_GET['data'] );
You must not trust data from the requests.
When you write code like this RIPS will point you this is the wrong style:
echo file_get_contents( 'files/' . $_GET['file'] );
You must not trust data from the requests. Similar for the include:
include( 'includes/' . $_GET['file'] );
RIPS understand possible XSS flows your WordPress theme or plugin may have and will warn you for this.
echo ( 'Hello ' . $_GET['name'] );
And when someone creates the request like this:
You need to encode request data since you cannot trust it if raw in this case.
header( 'Location: ' . $_GET['url'] );
Since PHP allows you to use
header() you cannot trust the request since someone may add
Set-Cookie: or similar inside. RIPS will help you check this.
Like explained in OWASP one may force session via
setcookie( 'PHPSESSID', $_GET['sessid'] );
like in here
Good thing RIPS can understand that and will update you.
eval( '\$color = \' . $_GET['color'] . '\';' );
You should not trust the request data.
'poc' => '/index.php?color=\';phpinfo();//',
or one modification of it called reflection injection
call_user_func( $_GET['func'] );
like in here:
exec( './crypto -mode ' . $_GET['mode'] );
RIPS will let you know for these possible problems.
Anyone heard for WordPress security heard for SQL injection concept.
mysql_query( 'SELECT * FROM users WHERE id = ' . $_GET['id'] );
If we add
/url?id=1 OR 1=1-- -',
RIPS will help you feel like the old security geek in here.