SAST Named

Static analysis finds patterns in source — run on YOUR $REPO, never stranger codebases without scope.

SAST Named• Audio Walkthrough

00:00/02:41

Visual · t17_sast_named

SAST = analyze source without running the app. Original Cyberlium.

SAST reads your mistakes before attackers do — but only on repos you are allowed to scan.

Static Application Security Testing tools (Semgrep, CodeQL, Bandit, ESLint security plugins) pattern-match source for injection, hardcoded secrets, weak crypto, and dangerous APIs. SAST runs in IDE or CI on commits you own. Learn tool categories and false-positive culture on $REPO — never point scanners at employer monoliths, open-source projects for 'practice,' or classmate private repos without permission. Defenders gate merges on SAST; attackers hope you skip it.

1. What SAST sees

Source paths, AST patterns, taint flows (in advanced tools), config files in repo.

Cannot fully verify runtime config — complements DAST and review.

Command guide

Try these commands — What SAST sees

═══ LINUX / BASH (Network & Reconnaissance Audit) ═══

Scan target host for open ports and service version signatures

Command — copy this

nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}

DNS and WHOIS reconnaissance on authorized domain

Command — copy this

dig +short A target.local
dig +short MX target.local
whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6

Inspect HTTP headers for technology stack fingerprinting

Command — copy this

curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"

Primary tools to practice this lesson: grep, python3. Reference sites: SAST (https://cheatsheetseries.owasp.org/cheatsheets/Source_Code_Analysis_Tools_Cheat_Sheet.html); Bandit (https://bandit.readthedocs.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.