Locked ApplicationInspector

[0x1]

ApplicationInspector v1.0.24

Microsoft Application Inspector is a software source code analysis tool that helps identify and surface well-known features and other interesting characteristics of source code to aid in determining what the software is or what it does.

This is the hidden content, please

• Sign In
• or
• Sign Up

Application Inspector is different from traditional static analysis tools in that it doesn’t attempt to identify “good” or “bad” patterns; it simply reports what it finds against a set of over 400 rule patterns for feature detection including features that impact security such as the use of cryptography and more. This can be extremely helpful in reducing the time needed to determine what Open Source or other components do by examining the source directly rather than trusting to limited documentation or recommendations.

The tool supports scanning various programming languages including C, C++, C#, Java, JavaScript, HTML, Python, Objective-C, Go, Ruby, PowerShell and more and includes HTML, JSON and text output formats with the default being an HTML report similar to the one shown here.

It includes a filterable confidence indicator to help minimize false positives matches as well as customizable default rules and conditional match logic.

Goals

Application Inspector helps inform you better for choosing the best components to meet your needs with a smaller footprint of unknowns for keeping your application attack surface smaller. It helps you to avoid inclusion of components with unexpected features you don’t want.

Application Inspector can help identify feature deltas or changes between component versions which can be critical for detecting injection of backdoors.

It can be used to automate detection of features of interest to identify components that require additional scrutiny as part of your build pipeline or create a repository of metadata regarding all of your enterprise application.

Basically, we created Application Inspector to help us identify risky third party software components based on their specific features, but the tool is helpful in many non-security contexts as well.

Application Inspector v1.0 is now in GENERAL AUDIENCE release status. Your feedback is important to us. If you’re interested in contributing, please review the CONTRIBUTING.md.

Getting Application Inspector

To use Application Inspector, download the relevant binary (either platform-specific or the multi-platform .NET Core release). If you use the .NET Core version, you will need to have .NET Core 3.0 or later installed. See the

This is the hidden content, please

• Sign In
• or
• Sign Up

or

This is the hidden content, please

• Sign In
• or
• Sign Up

files for help.

It might be valuable to consult the project wiki for additional background on Rules, Tags and more used to identify features. Tags are used as a systematic heirarchal nomenclature e.g. Cryptography.Protocol.TLS to more easily represent features.

Usage

Application Inspector is a command-line tool. Run it from a command line in Windows, Linux, or MacOS.

This is the hidden content, please

• Sign In
• or
• Sign Up

 

Examples:

Command Help

This is the hidden content, please

• Sign In
• or
• Sign Up

Analyze Command

This is the hidden content, please

• Sign In
• or
• Sign Up

Scan a project directory, with output sent to "output.html" (default behavior includes launching default browser to this file)

This is the hidden content, please

• Sign In
• or
• Sign Up

Add custom rules (can be specified multiple times)

This is the hidden content, please

• Sign In
• or
• Sign Up

Write to JSON format

This is the hidden content, please

• Sign In
• or
• Sign Up

Tagdiff Command

Use to analyze and report on differences in tags (features) between two project or project versions e.g. v1, v2 to see what changed

This is the hidden content, please

• Sign In
• or
• Sign Up

Simplist way to see the delta in tag features between two projects

This is the hidden content, please

• Sign In
• or
• Sign Up

Basic use

This is the hidden content, please

• Sign In
• or
• Sign Up

Basic use

This is the hidden content, please

• Sign In
• or
• Sign Up

TagTest Command

Used to verify (pass/fail) that a specified set of rule tags is present or not present in a project e.g. user only wants to know true/false if crytography is present as expected or if personal data is not present as expected and get a simple yes/no result rather than a full analyis report.

Note: The user is expected to use the custom-rules-path option rather than the default ruleset because it is unlikely that any source package would contain all of the default rules. Instead, create a custom path and rule set as needed or specify a path using the custom-rules-path to point only to the rule(s) needed from the default set.
Otherwise, testing for all default rules present in source will likely yield a false or fail result in most cases.

This is the hidden content, please

• Sign In
• or
• Sign Up

Simplest use to see if a set of rules are all present in a project

This is the hidden content, please

• Sign In
• or
• Sign Up

Basic use

This is the hidden content, please

• Sign In
• or
• Sign Up

Basic use

This is the hidden content, please

• Sign In
• or
• Sign Up

ExportTags Command

Simple export of the ruleset schema for tags representing what features are supported for detection

This is the hidden content, please

• Sign In
• or
• Sign Up

Export default rule tags to console

This is the hidden content, please

• Sign In
• or
• Sign Up

Using output file

This is the hidden content, please

• Sign In
• or
• Sign Up

With custom rules and output file

This is the hidden content, please

• Sign In
• or
• Sign Up

Verify Command

Verification that ruleset is compatible and error free for import and analysis

This is the hidden content, please

• Sign In
• or
• Sign Up

Simplist case to verify default rules

This is the hidden content, please

• Sign In
• or
• Sign Up

Using custom rules only

This is the hidden content, please

• Sign In
• or
• Sign Up

Download & more info

This is the hidden content, please

• Sign In
• or
• Sign Up