常用web漏洞扫描工具推荐漏洞扫描工具有哪些 _生活百科

对于pip-audit
pip-audit是一款功效宏大的安定缺点扫描东西，该东西重要对准Python情况，不妨扶助宏大接洽职员扫描和尝试Python包中的已知安定缺点。pip-audit运用了PythonPackagingAdvisory数据库PyPI *** ONAPI动作缺点汇报源。
功效引见
1、扶助对当地情况和依附组件（requirements作风文献）举行安定审批；
2、扶助多种缺点效劳（PyPI、OSV）；
3、扶助以CycloneDX XML或 *** ON *** 发送SBOM；
4、供给生人和呆板均可读的输入 *** （columnar、 *** ON）；
5、无缝接入 / 重用当地pip缓存；
东西安置
pip-audit鉴于Python开拓，且诉求当地情况为Python 3.7或革新本子。安置并摆设好Python情况之后，就不妨运用下列吩咐并经过pip来安置pip-audit了：
python -m pip install pip-audit第三方包
pip-audit的平常运转须要运用到多个第三方包，简直组件包称呼和本子如次图所示：
除此除外，咱们还不妨经过conda来安置pip-audit：
conda install -c conda-forge pip-audit
【常用web漏洞扫描工具推荐漏洞扫描工具有哪些】东西运用
咱们不妨径直将pip-audit以独力步调运转，或经过“python -m”运转：
pip-audit --helppython -m pip_audit --helpusage: pip-audit [-h] [-V] [-l] [-r REQUIREMENTS] [-f FORMAT] [-s SERVICE][-d] [-S] [--desc [{on,off,auto}]] [--cache-dir CACHE_DIR][--progress-spinner {on,off}] [--timeout TIMEOUT][--path PATHS] [-v] [--fix] [--require-hashes]audit the Python environment for dependencies with known vulnerabilitiesoptional arguments:-h, --helpshow this help message and exit-V, --versionshow program's version number and exit-l, --localshow only results for dependencies in the localenvironment (default: False)-r REQUIREMENTS, --requirement REQUIREMENTSaudit the given requirements file; this option can beused multiple times (default: None)-f FORMAT, --format FORMATthe format to emit audit results in (choices: columns,json, cyclonedx-json, cyclonedx-xml) (default:columns)-s SERVICE, --vulnerability-service SERVICEthe vulnerability service to audit dependenciesagainst (choices: osv, pypi) (default: pypi)-d, --dry-runwithout `--fix`: collect all dependencies but do notperform the auditing step; with `--fix`: perform theauditing step but do not perform any fixes (default:False)-S, --strictfail the entire audit if dependency collection failson any dependency (default: False)--desc [{on,off,auto}]include a description for each vulnerability; `auto`defaults to `on` for the `json` format. This flag hasno effect on the `cyclonedx-json` or `cyclonedx-xml`formats. (default: auto)--cache-dir CACHE_DIRthe directory to use as an HTTP cache for PyPI; usesthe `pip` HTTP cache by default (default: None)--progress-spinner {on,off}display a progress spinner (default: on)--timeout TIMEOUTset the socket timeout (default: 15)--path PATHSrestrict to the specified installation path forauditing packages; this option can be used multipletimes (default: [])-v, --verbosegive more output; this setting overrides the`PIP_AUDIT_LOGLEVEL` variable and is equivalent tosetting it to `debug` (default: False)--fixautomatically upgrade dependencies with knownvulnerabilities (default: False)--require-hashesrequire a hash to check each requirement against, forrepeatable audits; this option is implied when anypackage in a requirements file has a `--hash` option.(default: False)退出代码
工作实行后，pip-audit将会退出运转，并归来一个代码以表露其状况，个中：
0：未检验和测定到已知缺点；
1：检验和测定到了一个或多个已知缺点；
东西运用样例
审批暂时Python情况中的依附：
$ pip-auditNo known vulnerabilities found审批给定requirements文献的依附：
$ pip-audit -r ./requirements.txtNo known vulnerabilities found审批一个requirements文献，并废除体例包：
$ pip-audit -r ./requirements.txt -lNo known vulnerabilities found审批依附中创造的安定缺点：
$ pip-auditFound 2 known vulnerabilities in 1 packageNameVersion IDFix Versions----------- -------------- ------------Flask 0.5PYSEC-2019-179 1.0Flask 0.5PYSEC-2018-660.12.3审批依附（包括刻画）：
$ pip-audit --descFound 2 known vulnerabilities in 1 packageNameVersion IDFix Versions Description----------- -------------- ------------ --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------Flask 0.5PYSEC-2019-179 1.0The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded*** ON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.Flask 0.5PYSEC-2018-660.12.3The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides*** ON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.审批 *** ON *** 依附：

常用web漏洞扫描工具推荐漏洞扫描工具有哪些

推荐阅读

关于青岛公交703路简述青岛公交703路

Gw250磨合期多少公里换机油豪爵GW250摩托车性能如何

干铁皮石斛的吃法石斛的吃法

黑色大衣搭配什么颜色的围巾三种搭配最好看

南海区人才房 2023南海人才购房券什么时候发放

武汉一手房公积金贷款条件是什么

陕西宝鸡高风险地地区去珠海要几次核酸

幼字组词又字组词

请求会起名字的高人帮忙给单位同事的女儿起个好名字:姓王,属兔,1999年12月出生

痉挛性斜颈能针灸好吗

关于现代中医基础理论简述现代中医基础理论

干香菇泡发好了能放几天干香菇泡发好了可以放几天

羊绒衫第一次怎么洗如何洗羊绒衫

决明子菊花枸杞的功效决明子菊花枸杞有什么功效

如何提高照片饱和度

今日散水聚醚价格表今日散水聚醚价格

神将三国诸葛亮阵容搭配详解,诸葛亮阵容怎么搭配,新发布的哦

qq靓名大全

儿子像隔壁老王的说说儿子像隔壁老王

孕妇不可以睡凉席吗夏天孕妇可以睡凉席吗

常用web漏洞扫描工具推荐 漏洞扫描工具有哪些

推荐阅读

常用web漏洞扫描工具推荐漏洞扫描工具有哪些