OWASP ASST is an open-source, source-code scanner that traces data flow through PHP and Node.js projects and produces educational vulnerability reports for authorized security assessments and developer training.
| Tool | OWASP/ASST — automated software security toolkit that statically scans PHP and Node.js source against the OWASP Top 10:2025 and generates educational reports |
| Category | Static application security testing (SAST) / web vulnerability scanner |
| Primary Use | Auditing your own PHP, Laravel, WordPress, Symfony, and Node.js/Express codebases for injection flaws, stale dependencies, and OWASP Top 10 issues during development |
| Safe Use | Authorized use only: scanning code you own or are contracted to assess, in development labs, CI pipelines, and internal security reviews; the tool reads source code rather than attacking third-party systems |
| Telemetry Note | ASST is a local static analyzer — it leaves no traffic against external targets; opt-in live checks are read-only, and defenders will observe it only as a local process and generated report files (HTML, JSON, SARIF, Markdown) |
OWASP/ASST (Automated Software Security Toolkit, formerly AWSS) is an open-source, MIT-licensed static analysis tool written in JavaScript on Node.js that scans web application source code — principally PHP and, since v2, Node.js — for vulnerabilities mapped to the OWASP Top 10. The project sits under the OWASP umbrella and currently carries roughly 192 stars on GitHub, with an active CI workflow badge and semver-tagged releases. What distinguishes it from most free scanners is its explicitly educational posture: rather than emitting a bare finding, it tries to teach the developer what the vulnerability class means and how to fix it, which makes it better suited to secure-code programs than to break-and-enter engagements.
The tool's origin is a thesis release: v1.0.0 introduced the educational-report approach, and v2 is a substantial rebuild on top of that foundation. The README states that the original claim to novelty was scanning PHP against the OWASP Top 10 with per-finding explanations — at the time, the authors argue, no other open-source tool did that specifically for PHP. Whether or not that claim still holds in 2026, the v2 architecture is what makes the tool worth a second look, because it moves well past regex grepping into genuine data-flow reasoning over the parsed abstract syntax tree.
Internally, v2 performs data-flow analysis: PHP and Node.js code is parsed, and user input is followed from request sources through variables, functions, classes, and even across files, until it reaches a dangerous sink. Critically, the engine understands context-sensitive sanitization — it recognizes escaping and validation appropriate to where the value lands, whether that is SQL, HTML, shell commands, file paths, or URLs. Every finding shows the full path the data takes from source to sink, which dramatically cuts the false-positive noise that plagues simpler pattern matchers and gives reviewers something they can verify by eye.
Findings are annotated with the 2025 OWASP Top 10 category alongside the 2021 mapping, the associated CWE, plus a severity and a confidence level. That metadata framing matters for triage: a low-confidence SQL-injection trace through a framework helper is a different animal from a high-confidence direct mysqli_query() concatenation, and the report reflects that. Remediation guidance has been refreshed for PHP 8 and current Node.js practice, so the fix suggestions are less likely to reference deprecated APIs — a chronic weakness of older educational scanners.
Output is where ASST earns its pipeline credentials. Alongside the interactive HTML report linked with explanatory PDF documents for each attack class, v2 emits JSON, SARIF for GitHub code scanning, and Markdown, supports baselines for suppressing known/accepted findings, and provides CI exit codes so a scan can fail a build. There is an official GitHub Action and a Docker image, plus a benchmark harness that runs the tool against DVWA, NIST SARD, and WordPress — the presence of a benchmarking suite is a good sign of engineering discipline, since the authors claim comparative accuracy against other open-source scanners and give you the harness to check it yourself.
Framework and supply-chain coverage rounds out the feature set. Laravel, WordPress, and Symfony are supported as first-class scan targets, and a dedicated Node.js/Express scanner exists. On the supply-chain side, ASST reads dependencies from lock files and detects JavaScript libraries vendored directly into the project — a common source of silently rotting code. It flags end-of-life runtimes and frameworks, performs optional OSV.dev lookups for known advisories, and includes secrets detection with masked output so that a report meant to be shared does not itself leak credentials. An opt-in, read-only live check of the running site and a php.ini audit are also available for hardened deployments.
Deployment is straightforward for a CLI tool. You need Node.js 18 or newer — the README notes it is tested on Node.js 18, 20, 22, and 24 across Windows, Linux, and macOS — and for full PHP/MySQL functionality it expects a local stack such as XAMPP with the target project in htdocs. Configuration lives in two files: config.js, where DEFAULT_PROJECT_PATH_TO_SCAN names the project directory, and config_php_lang.js, where IS_DBMS_USED toggles database-aware analysis and PHP_EXE_BIN_PATH points at your PHP binary. A typical run after npm install is simply node main.js from the ASST directory, or double-clicking ASST.bat on Windows. Configuration files from v1.0 keep working across the upgrade.
The extension model is worth understanding before adopting it. The core scanning engine is deliberately stabilized: contributors are asked not to change core code without justification, language-specific cores may be improved, and new languages must follow the existing code design and file structure. The intended growth path is plugin-style additions for Java, C#, Python, and other backends, documented in CONTRIBUTING.md. For a security team, that means the PHP path is the mature one and any additional language support depends on community momentum — evaluate accordingly rather than assuming parity across stacks.
Caveats for operators: the README itself warns the tool is still under development and asks users to report errors, so treat results as one signal among several and verify high-severity findings manually. Also note the suggestion to run ASST directly on a production server because it checks server PHP and MySQL versions — if you do that, scope it to servers you own, run it in a change window, and prefer the read-only posture the tool documents. The opt-in live checks are explicitly read-only by design, which fits the tool's overall defensive character.
In an authorized workflow, ASST slots in naturally as a developer-facing gate: wire the GitHub Action into pull requests, emit SARIF into code scanning, use baselines to manage legacy debt, and let the explanatory reports do the security-education work that plain finding lists never accomplish. For blue teams and AppSec programs supporting PHP estates — especially WordPress and Laravel codebases that commercial SAST tools often handle poorly — it is a credible, free, teaching-oriented complement rather than a replacement for a full commercial pipeline.
OWASP/ASST.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.