Runtime Analysis of Vulnerabilities and Generation of Exploits
What is RAVAGE
Ravage is a Java runtime analysis tool built to accurately detect vulnerabilities. It leverages the standard program execution to detect the full dataflow of vulnerabilities at runtime. In addition to the offensive usage, it can also be used defensively by running existing non-security-related test cases to detect security vulnerabilities.
Key Highlights:
- Open Source RTA for Java
- Written in Java/C++/Assembly (~5k LOC)
- Monitors the program at runtime
- Detects when data flows from untrusted sources to sinks
- Can detect XSS, SQLi, static encryption keys, Sensitive data leaking via logs, App misconfigurations
Why RAVAGE
Low false positive rate
No exploit data needed
No source code needed
Detects vulnerabilities during standard usage
Can leverage existing testing
Complete dataflow
Using RAVAGE
Different ways you can use RAVAGE to detect vulnerabilities
Don’t panic if RAVAGE does not detect vulnerabilities, it is most likely the rules are not complete. Take some time to think about what kind of vulnerabilities you would like to detect, and write sources, sinks and passthrough rules for them.
If you think the rules are generic enough, please consider contributing back so that it can be shared with the community. Please download RAVAGE and refer to the README.md on how to build, run and extend RAVAGE.
- Run your existing test cases with RAVAGE
- Run RAVAGE with your application and use your application normally
- Run RAVAGE with your application and use black box scanners to drive your application
