Sentinal - Laravel Security Auditor

A comprehensive Laravel code auditor for detecting security vulnerabilities in Laravel applications.

Features

• SQL Injection Detection: Scans for vulnerable database queries
• XSS Vulnerability Scanner: Detects potential cross-site scripting vulnerabilities
• CSRF Protection Checker: Verifies CSRF token implementation
• Authentication Security: Analyzes authentication and authorization patterns
• Input Validation Scanner: Checks for proper input sanitization
• File Upload Security: Detects unsafe file upload practices
• Configuration Security: Analyzes security-related configuration files
• Dependency Vulnerability Check: Scans composer dependencies for known vulnerabilities
• Route Security Analysis: Checks for exposed sensitive routes
• Environment Variable Security: Validates .env file security

Installation

# Clone the repository
git clone <repository-url>
cd sentinal

# Install dependencies
composer install

# Copy configuration
cp .env.example .env

Usage

Basic Scan

# Scan a Laravel project
php bin/auditor scan /path/to/laravel/project

# Scan current directory
php bin/auditor scan .

Advanced Options

# Generate detailed report
php bin/auditor scan . --report=detailed

# Export to JSON
php bin/auditor scan . --format=json --output=security-report.json

# Scan specific vulnerability types
php bin/auditor scan . --vulnerabilities=sql-injection,xss,csrf

# Exclude directories
php bin/auditor scan . --exclude=vendor,tests,storage

Available Commands

• scan: Perform security audit on Laravel project
• check-dependencies: Check for vulnerable dependencies
• generate-report: Generate security report
• list-vulnerabilities: List all supported vulnerability types

Vulnerability Types Detected

High Priority

• SQL Injection vulnerabilities
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• Authentication bypass
• File upload vulnerabilities

Medium Priority

• Input validation issues
• Configuration security problems
• Route exposure risks
• Environment variable leaks

Low Priority

• Code quality issues
• Best practice violations
• Deprecated function usage

Configuration

Create a .env file with the following options:

# Scan settings
SCAN_DEPTH=3
MAX_FILE_SIZE=1048576
EXCLUDE_PATTERNS=vendor,tests,storage

# Report settings
REPORT_FORMAT=html
REPORT_OUTPUT_DIR=reports/

# Security settings
ENABLE_DEPENDENCY_CHECK=true
ENABLE_CVE_CHECK=true

Output Formats

• Console: Real-time output in terminal
• HTML: Detailed HTML report
• JSON: Machine-readable JSON format
• CSV: Comma-separated values for spreadsheet analysis

Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests
5. Submit a pull request

License

MIT License - see LICENSE file for details.

Security

If you discover any security-related issues, please email [email protected] instead of using the issue tracker.