ocular.scala

git clone [email protected]:conikeec/tarpit.git

cd tarpit

mvn clean compile 

// Download trial distribution of Ocular. Install and thereafter fire up the prompt to commence investigation

./ocular.sh

createCpgAndSp("/Users/chetanconikee/demoenv/tarpit/target/servlettarpit.war")
res0: Option[Cpg] = Some(io.shiftleft.codepropertygraph.Cpg@3a183218)

workspace
res5: Workspace =
 __________________________________________________________________________________________
 | name                  | overlays                                                | loaded|
 |=========================================================================================|
 | servlettarpit.war     | semanticcpg(l),dataflow(l),tagging(l),securityprofile(l)| true  |
 
// CPG is created and loaded to commence investigation

// Get all sensitive data types classfied by the NLP engine
val sensitiveTypes = getSensitiveUserDefinedTypes(cpg)

// Verify if PII data is leaking on a sensitive channel without obfuscation/redaction
val isPIILeaking = isPIILeaking(sensitiveTypes)

// Identify if any literals match patterns (AWS/Azure keys, JWT Tokens, SaaS tokens, etc)
val areTokensLeaking = areTokensLeaking(cpg)

// Identify if any environmental or system data fetched is leaking?
val areEnvVarsLeaking = areEnvTokensLeaking(cpg)

// Identify if any Annotated models marked are violating complaince constraints 
val areAnnotatedModelsLeaking = getAnnotatedModels(cpg)