TOP 10 PHP Vulnerability Scanners

In today’s world, automation is the name of the game. People expect a faster way to do the job, to meet deadlines and settle obligations. Same goes with the security industry, the system administrator profession, and web development jobs; automation lessens the time to finish the tasks. PHP, a well-known language in web development is a very mature language. First appeared as a niche scripting-compatible language for the web in 1995, it grew popularity and provided cross-platform compatibility for the web.

Vulnerability scanners for PHP code are popular in the web developer circle, lessening the chance of insecure code from being published on a website. Here are some of them:

Grabber

It is a simple and straightforward PHP-SAT based scanner app developed using the universal Python language.

PHP Vulnerability Hunter

This can be considered as a counterpart of an antivirus for Windows, an antimalware specifically developed for scanning vulnerabilities in a PHP system. It maintains and updates its own database of signatures for detecting the latest exploits against PHP.

Progpilot

It is a simple PHP checking application, it scans the cookies produced by the website, detect malicious GET and POST pages. It is cross-platform, supporting suite CRM and CodeIgniter systems.

Checkmarx

One of a few that is purely cloud-based, Checkmarx scans a PHP site for known exploitable parts and presents it to the developer in an easy to read way. It provides useful links to external site on how to fix the vulnerabilities detected.

Psalm

Built on top of PHP Parser, it is an entry-level error finding an app for PHP.

PHPStan

It is a full-fledged debugger for PHP. It is a real-time code checker, a real-time code correction app for PHP. Available as an online service.

Exakat

A comprehensive and flashy app to scan and detect PHP vulnerabilities. Exakat is an app composed for at least 300 analyzers as of this writing. It has a wide-ranging support that targets various CMS like Zend, WordPress and CakePHP. It is one of the best apps in this list as it directly supports PHP codes under the GitHub repository. As a bonus, it has a module that can simplify the transition to PHP 7 from an older version of PHP.

SensioLabs

It is a security-centered PHP scanner. It features a multi-interface system with versions available as CLI, API and online. The API is wide-ranging, enabling developers to extend the capabilities of SensiLabs.

Sonar PHP

It is built with detecting PHP vulnerabilities through the utilization of pattern matching. Exploits existing in the PHP code are easily detected by matching signatures of most common PHP vulnerabilities, the bonus is the tight integration with Eclipse, a multipurpose IDE.

RIPS

The most common PHP vulnerability scanner, the app is fully Hippa-compliant. Real-time scanning is part of the package and enables fixing of known PHP security issues in a very easy to use interface. It categorizes exploits, with a strong focus on fixing critical vulnerabilities. It contains links pointing the web developer to the correct information of where to further research about the detected vulnerabilities.