Skip to content

Rough Auditing Tool for Security

The Rough Auditing Tool for Security (RATS) is a program for automated code review. It analyzes C, C++, Perl, PHP and Python source code and identifies potential security related programming errors such as buffer overflows or race conditions. The tool performs only a first rough analysis as a basis for a manual code review.

RATS is Free / Libre Open Source Software under the GNU General Public License and is available for Linux and Windows.

Requirements

RATS requires expat to be installed in order to build and run. Expat is often installed in /usr/local/lib and /usr/local/include. On some systems, you will need to specify --with-expat-lib and --with-expat-include options to configure so that it can find your installation of the library and header.

Expat can be found at: http://expat.sourceforge.net/

Installation

Building and installation of RATS is simple. To build, you simply need to run the configuration shell script in the distribution's top-level directory: 

$ ./configure

The configuration script is a standard autoconf generation configuration script and accepts many options. Run configure with the --help option to see what options are available. Once the configuration script has completed successfully, simply run make in the distribution's top-level directory to build the program: 

$ make

By default, RATS will be installed to /usr/local/bin and its vulnerability database will be installed to /usr/local/lib. You may change the installation directories of both with the --prefix option to configure. You may optionally use the --bindir and --datadir to specify more precise locations for the files that are installed. To install after building, simply run make with the install target: 

$ make install

Running RATS

Once you have built and installed RATS, it's time to start auditing your software! RATS accepts a few command line options that will be described here and accepts a list of files to audit on the command line. If no files to audit are specified, stdin will be used. Usage: 

$ rats [-d ] [-h] [-r] [-w ] [-x] [file1 file2 ... filen]

Options explained

  • -d: Specifies a vulnerability database to be loaded. You may have multiple -d options and each database specified will be loaded.
  • -h: Displays a brief usage summary
  • -i: Causes a list of function calls that were used which accept external input to be produced at the end of the vulnerability report.
  • -l: Force the specified language to be used regardless of filename extension. Currently valid language names are "c", "perl", "php" and "python".
  • -r: Causes references to vulnerable function calls that are not being used as calls themselves to be reported.
  • -w: Sets the warning level. Valid levels are 1, 2 or 3. Warning level 1 includes only default and high severity Level 2 includes medium severity. Level 2 is the default warning level 3 includes low severity vulnerabilities.
  • -x: Causes the default vulnerability databases (which are in the installation data directory, /usr/local/lib by default) to not be loaded.

When started, RATS will scan each file specified on the command line and produce a report when scanning is complete. What vulnerabilities are reported in the final report depend on the data contained in the vulnerability database or databases that are used and the warning level in use.

For each vulnerability, the list of files and line numbers where it occurred is given, followed by a brief description of the vulnerability and suggested action.

Favorite site