Secure › Module 7 › Lesson 1
SAST Named
Static analysis finds patterns in source — run on YOUR $REPO, never stranger codebases without scope.
Visual · t17_sast_named
SAST = analyze source without running the app. Original Cyberlium.
Opening
SAST reads your mistakes before attackers do — but only on repos you are allowed to scan.
Static Application Security Testing tools (Semgrep, CodeQL, Bandit, ESLint security plugins) pattern-match source for injection, hardcoded secrets, weak crypto, and dangerous APIs. SAST runs in IDE or CI on commits you own. Learn tool categories and false-positive culture on $REPO — never point scanners at employer monoliths, open-source projects for 'practice,' or classmate private repos without permission. Defenders gate merges on SAST; attackers hope you skip it.
1. What SAST sees
Source paths, AST patterns, taint flows (in advanced tools), config files in repo.
Cannot fully verify runtime config — complements DAST and review.
Command guide
Try these commands — What SAST sees
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"Primary tools to practice this lesson: grep, python3. Reference sites: SAST (https://cheatsheetseries.owasp.org/cheatsheets/Source_Code_Analysis_Tools_Cheat_Sheet.html); Bandit (https://bandit.readthedocs.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tool families
Language-specific (Bandit for Python, gosec for Go) vs multi-language (Semgrep).
IDE plugins for fast feedback; CI for team gate.
3. Scope
Default lab: clone and scan YOUR $REPO or course starter you forked.
No bulk scanning GitHub orgs you do not own — rate limits and ethics apply.
4. What you ship: SAST vocabulary
SAST definition + two tool names + $REPO-only scan rule.
5. What you record before the next lesson
SAST named paragraph.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run Semgrep against employer private repo without authorization.
Right
Name SAST and tools. Next: findings triage.
Mission: SAST literacy sheet
1) Define SAST in one sentence. 2) Name two tools for your stack. 3) Write NEVER scan stranger repos.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Semgrep vs CodeQL tradeoff?”
Knowledge Check
APPLY: SAST analyzes:
Multiple choice
Knowledge Check
APPLY: True or False: Scanning classmate private repo without OK is lab.
True or False
Knowledge Check
APPLY: SAST runs best early:
Multiple choice