Contents

Features

Precise Reachable data-flows

Clear insights about CVEs

Automatic prioritization

Stay proactive

Vulnerability Data sources

Linux distros

Quick Start

Scanning projects locally (Python version)

sudo npm install -g @cyclonedx/cdxgen# Normal version recommended for most users (MIT)pip install owasp-depscan# For a full version with all extensions and server mode (Multiple Licenses)pip install owasp-depscan[all]

cd<project to scan>depscan --src$PWD --reports-dir$PWD/reports

usage: depscan [-h] [--config CONFIG] [--no-banner] [-i SRC_DIR_IMAGE] [-o REPORTS_DIR] [--csaf]               [--profile {appsec,research,operational,threat-modeling,license-compliance,generic,machine-learning,ml,deep-learning,ml-deep,ml-tiny}]               [--lifecycle {pre-build,build,post-build} [{pre-build,build,post-build} ...]]               [--technique {auto,source-code-analysis,binary-analysis,manifest-analysis,hash-comparison,instrumentation,filename} [{auto,source-code-analysis,binary-analysis,manifest-analysis,hash-comparison,instrumentation,filename} ...]]               [--bom-engine {auto,CdxgenGenerator,CdxgenServerGenerator,CdxgenImageBasedGenerator,BlintGenerator} |               --vulnerability-analyzer {auto,VDRAnalyzer,LifecycleAnalyzer}] [--reachability-analyzer {off,FrameworkReachability,SemanticReachability}] [--no-suggest]               [--risk-audit] [--cdxgen-args CDXGEN_ARGS] [--private-ns PRIVATE_NS] [-t PROJECT_TYPE [PROJECT_TYPE ...]] [--bom BOM | --bom-dir BOM_DIR | --purl SEARCH_PURL]               [--report-template REPORT_TEMPLATE] [--report-name REPORT_NAME] [--deep] [--fuzzy-search] [--search-order {purl,pcu,cpe,cpu,url}] [--no-universal]               [--no-vuln-table] [--server] [--server-host SERVER_HOST] [--server-port SERVER_PORT] [--cdxgen-server CDXGEN_SERVER] [--debug] [-q | --explain] [-v]Fully open-source security and license audit for application dependencies and container images based on known vulnerabilities and advisories.options:  -h, --help            show this help message and exit  --config CONFIG       Path to the configuration file. Default: $PWD/.config/depscan.toml  --no-banner           Do not display the logo and donation banner. Please make a donation to OWASP before using this argument.  -i, --src SRC_DIR_IMAGE                        Source directory or container image or binary file  -o, --reports-dir REPORTS_DIR                        Reports directory  --csaf                Generate a OASIS CSAF VEX document  --profile {appsec,research,operational,threat-modeling,license-compliance,generic,machine-learning,ml,deep-learning,ml-deep,ml-tiny}                        Profile to use while generating the BOM. For granular control, use the arguments --bom-engine, --vulnerability-analyzer, or --reachability-analyzer.  --lifecycle {pre-build,build,post-build} [{pre-build,build,post-build} ...]                        Product lifecycle for the generated BOM. Multiple values allowed.  --technique {auto,source-code-analysis,binary-analysis,manifest-analysis,hash-comparison,instrumentation,filename} [{auto,source-code-analysis,binary-analysis,manifest-analysis,hash-comparison,instrumentation,filename} ...]                        Analysis technique to use for BOM generation. Multiple values allowed.  --bom-engine {auto,CdxgenGenerator,CdxgenServerGenerator,CdxgenImageBasedGenerator,BlintGenerator}                        BOM generation engine to use. Defaults to automatic selection based on project type and lifecycle.  --vulnerability-analyzer {auto,VDRAnalyzer,LifecycleAnalyzer}                        Vulnerability analyzer to use. Defaults to automatic selection based on bom_dir argument.  --reachability-analyzer {off,FrameworkReachability,SemanticReachability}                        Reachability analyzer to use. Default FrameworkReachability.  --no-suggest          Disable suggest mode  --risk-audit          Perform package risk audit (slow operation). Npm only.  --cdxgen-args CDXGEN_ARGS                        Additional arguments to pass to cdxgen  --private-ns PRIVATE_NS                        Private namespace to use while performing oss risk audit. Private packages should not be available in public registries by default. Comma separated                        values accepted.  -t, --type PROJECT_TYPE [PROJECT_TYPE ...]                        Override project types if auto-detection is incorrect. Multiple values supported.  --bom BOM             Examine using the given Software Bill-of-Materials (SBOM) file in CycloneDX format. Use cdxgen command to produce one.  --bom-dir BOM_DIR     Examine all the Bill-of-Materials (BOM) files in the given directory.  --purl SEARCH_PURL    Scan a single package url.  --report-template REPORT_TEMPLATE                        Jinja template file used for rendering a custom report  --report-name REPORT_NAME                        Filename of the custom report written to the --reports-dir  --deep                Perform deep scan by passing this --deep argument to cdxgen. Useful while scanning docker images and OS packages.  --fuzzy-search        Perform fuzzy search by creating variations of package names. Use this when the input SBOM lacks a PURL.  --search-order {purl,pcu,cpe,cpu,url}                        Attributes to use while searching for vulnerabilities. Default: PURL, CPE, URL (pcu).  --no-universal        Depscan would attempt to perform a single universal scan instead of individual scans per language type.  --no-vuln-table       Do not print the table with the full list of vulnerabilities. This can help reduce console output.  --server              Run depscan as a server  --server-host SERVER_HOST                        depscan server host  --server-port SERVER_PORT                        depscan server port  --cdxgen-server CDXGEN_SERVER                        cdxgen server url. Eg: http://cdxgen:9090  --debug               Run depscan in debug mode.  -q, --quiet           Makes depscan quiet.  --explain             Makes depscan to explain the various analysis. Useful for creating detailed reports.  --explanation-mode {Endpoints,EndpointsAndReachables,NonReachables}                        Style of explanation needed. Defaults to Endpoints and Reachables.  --annotate            Include the generated text VDR report as an annotation. Defaults to true when explain is enabled; false otherwise.  -v, --version         Display the version

Scanning containers locally (Python version)

depscan --src<path> -o containertests -t java

depscan --src shiftleft/scan-slim -o containertests -t docker

depscan --src shiftleft/scan-slim -o containertests -t docker license

depscan --src redmine@sha256:a5c5f8a64a0d9a436a0a6941bc3fb156be0c89996add834fe33b66ebeed2439e -o containertests -t docker

docker save -o /tmp/scanslim.tar shiftleft/scan-slim:latest# podman save --format oci-archive -o /tmp/scanslim.tar shiftleft/scan-slim:latestdepscan --src /tmp/scanslim.tar -o reports -t docker

Scanning projects locally (Docker container)

docker run --rm -v$PWD:/app ghcr.io/owasp-dep-scan/dep-scan depscan --src /app --reports-dir /app/reports

docker run --rm \    -e VDB_HOME=/db \    -e GITHUB_TOKEN=<token> \    -v /tmp:/db \    -v$PWD:/app ghcr.io/owasp-dep-scan/dep-scan depscan --src /app --reports-dir /app/reports

Server mode

git clone https://github.com/owasp-dep-scan/dep-scandocker compose up

depscan --server --server-host 0.0.0.0 --server-port 7070

# This would take over 2 minutescurl http://0.0.0.0:7070/download-vdb

Note

Thetype parameter is mandatory in server mode.

curl --json'{"path": "/tmp/vulnerable-aws-koa-app/sbom_file.json", "type": "js"}' http://0.0.0.0:7070/scan

curl --json'{"url": "https://github.com/HooliCorp/vulnerable-aws-koa-app", "type": "js"}' http://0.0.0.0:7070/scan -o app.vdr.json

curl -X POST -H'Content-Type: multipart/form-data' -F'file=@/tmp/app/sbom_file.json' http://0.0.0.0:7070/scan?type=js

Local development

uv sync --all-extras --all-packagesuv run depscan --helpuv run pytest

Local VDB setup

vdb --cleanvdb --download-image# To scan containers and OS images# vdb --download-full-image

Scan local depscan

uv run depscan --config .config/depscan-dev.toml

License

Funding