Dawnscanner

What Dawnscanner is

Dawnscanner is a Ruby security scanner that examines source code for web application vulnerabilities. It reads a project’s Gemfile.lock to identify the Ruby version and MVC framework, then applies relevant checks for Ruby on Rails, Sinatra, or Padrino. Its knowledge base includes NIST CVE bulletins, custom checks, and OWASP Ruby on Rails cheat-sheet recommendations; the README says version 2.0 includes more than 680 security checks. It can inspect view code and trace sinks to identify cross-site scripting and SQL injection issues. Results list vulnerabilities and mitigation actions, but are provided in text format only. Dawnscanner runs locally from the command line on Linux or in a self-hosted setup. Installation uses `gem install dawnscanner`, and the knowledge base must be downloaded separately. The README mentions GitHub hooks as one way to include it in a release process. Dawnscanner is open source and MIT licensed, with a free plan listed as free. The knowledge-base repository lists v20240116 as its latest release.

Who it suits

Dawnscanner suits Ruby teams working with Rails, Sinatra, or Padrino that want locally run source scanning and mitigation guidance. It may also suit teams looking to include scanning in a release process using GitHub hooks.

Getting started

1. Open the Dawnscanner GitHub repository.
2. Install the tool with `gem install dawnscanner`.
3. Download the knowledge base separately.
4. Run it against a Ruby web application on Linux or in a self-hosted setup.
5. Consider GitHub hooks as an example of integrating it into a release process.

Verdict

Dawnscanner combines framework-aware Ruby checks with view-code analysis and mitigation guidance. Its text-only results and separate knowledge-base download are worth considering before adopting it.