OWASP Noir: Open-Source Static Code Analysis Tool for Security

Post Views: 6

OWASP Noir is a free, open-source static analysis tool designed to examine application source code and identify exposed endpoints.

Key Features

OWASP Noir catalogs paths, HTTP methods, parameters, headers, and cookies, linking each to the specific file and line number in the codebase. A key feature is its ability to reveal shadow APIs—routes that exist in the code but are not documented, alongside deprecated endpoints and undocumented handlers.

Comparison with Dynamic Tools

This contrasts with dynamic scanning tools like ZAP and Burp Suite, which rely on external probing of running applications. These tools may miss routes if their crawlers do not reach them, leaving potential vulnerabilities untested.

Supported Languages and Frameworks

The tool supports 29 programming languages and 205 frameworks through a single executable, eliminating the need for plugins or language-specific configurations. It automatically detects the programming language, framework, and routing conventions.

Integration with LLMs

When static analysis rules fail to recognize a framework or custom routing logic, Noir integrates with large language models (LLMs) via providers such as OpenAI or Ollama. However, results from LLM-generated routes require manual validation before being trusted.

Passive Scanning

Noir includes passive scanning rules that assess code for hardcoded credentials, tokens, and keys, assigning severity levels to potential risks.

User Groups

The tool’s architecture caters to three primary user groups: human reviewers who analyze attacker-facing entry points, AI-based code auditors that leverage the tool’s structured data for model-driven analysis, and dynamic application security testing (DAST) tools like ZAP, Burp Suite, Caido, and Gori, which can use Noir’s output as a proxy target or OpenAPI import.

Output Formats

Output formats include JSON, SARIF, OpenAPI, Postman, and cURL, with integration available as a GitHub Action for continuous integration pipelines.

GitHub Hosting

The project is hosted on GitHub, offering developers and security professionals a centralized resource for enhancing code security through static analysis.