Xaliom's Blog

 From SAST to CVE-2025-46337 From the start of my career in cybersecurity, I have always worked as a black box pentester. Since I believe that learning new topics is always a good use of my time and that I should increase my knowledge of white box pen testing, I decided to explore the Static Analysis Security Testing (SAST) topic. I started my journey into SAST using the well-known tool SonarQube. To practice with the tool and to become familiar with the GUI and the mechanisms that are behind it, I decided to analyze the code of a few known projects. I chose two projects to analyze. The first one is "Moodle", a very well-known open-source project whose main purpose is to create websites for universities. The second is VtigerCRM, a familiar project on which I discovered several CVEs last summer. I started the SAST first against the source code of Moodle and then against the source code of VtigerCRM. Surprisingly, SonarQube found an SQL Injection on both projects! Since the sou...

 Setting Up SonarQube on a Unix VM Prerequisite: A Unix VM with at least 4GB of RAM (8GB recommended)( link ) Shopping List: SonarQube Web Server "Community Edition" ( link ) SonarQube Scanner ( link ) Abstract: In this blog post, we will go through the steps to set up a SonarQube instance to analyze the source code of an application on an Ubuntu VM. If you're unfamiliar with SonarQube, it is an excellent open-source SAST tool designed to integrate with various CI/CD platforms. Once we have a fully functional Ubuntu VM with at least 4GB of RAM (I recommend using 8GB if possible), we need to set up both the SonarQube web server and the SonarQube scanner. Installing the SonarQube Web Server: Let's download the SonarQube Web Server by visiting the link showed above and clicking on the highlighted button: https://www.sonarsource.com/products/sonarqube/downloads/                  Let's close the pop-up to start the download clicking on the ...