gosoaap

A Go library for working with SOAAP results, as they are emitted by the SOAAP tool in the textual JSON format.

Installation

1. Install Go

2. FreeBSD: pkg install go

3. Mac OS X: brew install go

4. From source

5. Set the GOPATH environment variable, e.g.:

   $ export GOPATH=$HOME/.go

6. Fetch and build this repository:

   $ go get github.com/CTSRD-SOAAP/gosoaap

Commands

The library includes some command-line tools:

soaap-parse

This tool parses the JSON output from SOAAP and converts it to a binary format that other Go SOAAP tools can read. The .gob file extension (see gob package documentation) is recommended so that other tools can detect the use of the binary format without having to examine the file itself:

$ soaap-parse --output=soaap.gob soaap-output.json

soaap-graph

This tool opens a JSON or .gob file and converts it to a call graph in the GraphViz DOT format. It currently only supports graphing the calls reachable from SOAAP past-vulnerability warnings. Usage:

$ soaap-graph --output=soaap.dot soaap.gob
$ dot -Tpdf -o soaap.pdf soaap.dot

Library API

API documentation can be viewed at godoc.org.