# \[ANN\] dawn - security static source code scanner per ruby

**URL:** <https://www.ruby-forum.com/t/ann-dawn-security-static-source-code-scanner-per-ruby/228928>\
**Category:** IT\
**Created:** [May 13, 2013, 2:04pm UTC](https://www.ruby-forum.com/t/ann-dawn-security-static-source-code-scanner-per-ruby/228928 "2013-05-13T14:04:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![paolo\_p](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ecc23a/32.png) [@paolo\_p](https://www.ruby-forum.com/u/paolo_p)\
**Post date:** [May 13, 2013, 2:04pm UTC](https://www.ruby-forum.com/t/ann-dawn-security-static-source-code-scanner-per-ruby/228928/1 "2013-05-13T14:04:06Z")

</div>

Ciao ragazzi, voi conoscere [http://brakemanscanner.org/](http://brakemanscanner.org/) e lasciatemi  
dire  
che un tool fantastico.

Io da sempre ho il pallino di unire la code review ai penetration test,  
tanto che avevo fatto partire il progetto Owasp Orizon nel 2006. Ho  
deciso  
quindi di partire con un nuovo progetto mio su questo tema, quello della  
code review.

dawn non un tool solo per Rails ma supporta anche sinatra e padrino. Ad  
oggi il numero di check limitato e non vengono testati XSS e  
SQLinjection  
a parte quelli che affliggevano i framework in se.

Questa la pagina su rubygems: [codesake-dawn | RubyGems.org | your community gem host](https://rubygems.org/gems/codesake-dawn)  
Questa la pagina su github dove trovate anche la roadmap:  
[GitHub - thesp0nge/dawnscanner: Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.](https://github.com/codesake/codesake_dawn)

Che ne dite?

## Paolo

$ cd /pub  
$ more beer

The Application Security blog you really want to read:

> **[Home](http://armoredcode.com)**
>
> {% if page.url ==

---

<div class="post-metadata">

**Author:** ![paolo\_p](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ecc23a/32.png) [@paolo\_p](https://www.ruby-forum.com/u/paolo_p)\
**Post date:** [May 13, 2013, 10:04pm UTC](https://www.ruby-forum.com/t/ann-dawn-security-static-source-code-scanner-per-ruby/228928/2 "2013-05-13T22:04:32Z")

</div>

Ciao,

sar che anche io ho lo stesso pallino :), ma secondo me il progetto  
veramente interessante … lo seguir con attenzione, cercando magari  
di contribuire !!

Complimenti

Giuseppe

---

<div class="post-metadata">

**Author:** ![paolo\_p](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ecc23a/32.png) [@paolo\_p](https://www.ruby-forum.com/u/paolo_p)\
**Post date:** [May 14, 2013, 2:42pm UTC](https://www.ruby-forum.com/t/ann-dawn-security-static-source-code-scanner-per-ruby/228928/3 "2013-05-14T14:42:06Z")

</div>

Grande Paolo 🙂  
Seguir anche io gli sviluppi!

Il giorno 13 maggio 2013 22:04, Giuseppe D.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)ha scritto:

> On 13/05/2013 14:03 , Paolo P. wrote:
> 
> > testati XSS e SQLinjection a parte quelli che affliggevano i
> 
> * * *
> 
> Ml mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [http://lists.ruby-it.org/mailman/listinfo/ml](http://lists.ruby-it.org/mailman/listinfo/ml)

–  
Andrea N.

Twitter: @andrenodari  
Website: [nodo.github.io](http://nodo.github.io)

---

<div class="post-metadata">

**Author:** ![paolo\_p](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ecc23a/32.png) [@paolo\_p](https://www.ruby-forum.com/u/paolo_p)\
**Post date:** [May 15, 2013, 10:01am UTC](https://www.ruby-forum.com/t/ann-dawn-security-static-source-code-scanner-per-ruby/228928/4 "2013-05-15T10:01:16Z")

</div>

Ciao Riccardo, sto provando a rispondere qui:  
[https://github.com/codesake/codesake\_dawn/blob/master/Competitive\_matrix.md#the-matrix](https://github.com/codesake/codesake_dawn/blob/master/Competitive_matrix.md#the-matrix)

Ho iniziato questa mattina… integrer nei prox giorni con un confronto  
sulla knowledge base.  
Paolo

On 14 May 2013 18:17, Riccardo T. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> [http://lists.ruby-it.org/mailman/listinfo/ml](http://lists.ruby-it.org/mailman/listinfo/ml)

–  
$ cd /pub  
$ more beer

The Application Security blog you really want to read:

> **[Armored Code](https://armoredcode.com/)**
>
> Independent research on application security, vulnerability research, secure software engineering, and open-source security tooling by Paolo Perego.

---

<div class="post-metadata">

**Author:** ![paolo\_p](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ecc23a/32.png) [@paolo\_p](https://www.ruby-forum.com/u/paolo_p)\
**Post date:** [May 14, 2013, 6:17pm UTC](https://www.ruby-forum.com/t/ann-dawn-security-static-source-code-scanner-per-ruby/228928/5 "2013-05-14T18:17:48Z")

</div>

Complimenti per il progetto. Che differenza c’è fra brakeman e la tua  
gem? La provero`e leggero` un po` il codice.

Ciao