0

I heard for OWASP, and in there I found references for PHP scripts scanner called RIPS.

  • Should I use it on daily bases to test my WordPress plugins and themes?
  • Should I use it also to test other WordPress plugins and themes?
0

Yes, and yes, RIPS is an excellent tool to do both.

You can use it to check the quality of your WordPress themes and plugins or any other WordPress theme and plugin.

RIPS is a static code analysis tool to automatically detect vulnerabilities in PHP applications. By tokenizing and parsing all source code files RIPS is able to transform PHP source code into a program model and to detect sensitive sinks (potentially vulnerable functions) that can be tainted by user input (influenced by a malicious user) during the program flow. Besides the structured output of found vulnerabilities RIPS also offers an integrated code audit framework for further manual analysis.

Here is how it works simplified.

File Manipulation

This usage would not be smart and RIPS will detect the possible flows

$h = fopen( $_GET['file'],  'w' );  
fwrite( $h,  $_GET['data'] );  

You must not trust data from the requests.

File Disclosure

When you write code like this RIPS will point you this is the wrong style:

echo file_get_contents( 'files/' . $_GET['file'] );  

You must not trust data from the requests. Similar for the include:

include( 'includes/' . $_GET['file'] );

Cross-Site Scripting

RIPS understand possible XSS flows your WordPress theme or plugin may have and will warn you for this.

echo ( 'Hello ' . $_GET['name'] );  

And when someone creates the request like this:

/url?name=<script>alert(1)</script>

You need to encode request data since you cannot trust it if raw in this case.

Response splitting

header( 'Location: ' . $_GET['url'] );

Since PHP allows you to use header() you cannot trust the request since someone may add Set-Cookie: or similar inside. RIPS will help you check this.

Fixed sessions

Like explained in OWASP one may force session via setcookie()

setcookie( 'PHPSESSID', $_GET['sessid'] );

like in here

/url?sessid=1f3870be274f6c49b3e31a0c6728957f' 

Good thing RIPS can understand that and will update you.

Code injection

eval( '\$color = \' . $_GET['color'] . '\';' );

You should not trust the request data.

'poc' => '/index.php?color=\';phpinfo();//',

or one modification of it called reflection injection

call_user_func( $_GET['func'] );

like in here:

/url?func=phpinfo'

Similar for exec()

 exec( './crypto -mode ' . $_GET['mode'] );

RIPS will let you know for these possible problems.

SQL injection

Anyone heard for WordPress security heard for SQL injection concept.

mysql_query( 'SELECT * FROM users WHERE id = ' . $_GET['id'] );

If we add

/url?id=1 OR 1=1-- -',

RIPS will help you feel like the old security geek in here.


There are more security checks RIPS can do for you I haven't mentioned in here. Download it and start checking your WordPress themes and plugins.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.