RATS(1)

🐀 RATS(1) — the manual, but make it slay ✨

okay bestie, so this is rats(1), from the General Commands Manual section. Yes, section one. Yes, we're doing this. Sit down, grab a boba, and let's get into it 💖

---

🌸 NAME 🌸

rats — the Rough Auditing Tool for Security. That's it, that's the name, and it absolutely ate 🔥

---

🦋 SYNOPSIS 🦋

rats [options] [file]...

---

✨ DESCRIPTION ✨

So rats is a rough auditing tool for security, developed by Secure Software, Inc. She scans C, Perl, PHP, and Python source code and flags those common security-related programming errors we all pretend we'd never write — think buffer overflows and TOCTOU (Time Of Check, Time Of Use) race conditions. Classic. Iconic, even.

But here's the vibe check, bestie: like her name literally says, she does a rough analysis of source code. That means she will not find every error, and she will also find things that are not errors at all. Not her fault, she's doing her best 💅. Manual inspection of your code is still necessary — but this tool makes it so much easier. Not me hyping up a static analyzer, but here we are 🫶

When you start her up, RATS scans each file — or each file in each directory — that you specified on the command line, and she produces a report when the scanning is complete. Which vulnerabilities show up in that final report depends on the data inside the vulnerability database(s) being used, plus the warning level you've got going. Mix and match, it's giving customizable ✨

For every vulnerability, she gives you the list of files and line numbers where it occurred, followed by a brief description of the vulnerability and a suggested action. So you get the tea and the fix. Obsessed.

---

👑 OPTIONS 👑

• -h, --help — shows you a brief usage summary and then exits. The "help me bestie" button 🎀
• -a <fun> — reports any occurrence of the function fun in the source file(s). Any. Single. One. She's thorough like that.
• -d <filename>, --database <filename>, --db <filename> — specifies a vulnerability database to be loaded. And listen, you can pass multiple -d options, and each database you specify will be loaded. Stack 'em up, queen 👑
• -i, --input — causes a list of function calls that were used which accept external input to be produced at the end of the vulnerability report. Receipts, but for input 💀
• -l <lang>, --language <language> — forces the specified language to be used regardless of the filename extension. Currently valid language names are "c", "perl", "php" and "python". Don't try anything else, she will not play along.
• -r, --references — causes references to vulnerable function calls that are not being used as calls themselves to be reported. Sneaky little mentions, we see them 👀
• -w <level>, --warning <level> — sets the warning level. Valid levels are 1, 2 or 3.
  • 1 includes only default and high severity.
  • 2 includes medium severity (default).
  • 3 includes low severity vulnerabilities.
• -x — causes the default vulnerability databases (which are in the installation data directory, /usr/share/rats by default) to not be loaded. Going rogue, no defaults, only your own dbs 💅
• -R, --no-recurssion — do not recurse subdirectories when encountered. (And yes, it's spelled no-recurssion with the double s, that's just how she is, we don't fix her, we love her 💖)
• --xml — output in XML. Machine-readable era.
• --html — output in HTML. For when you want your vulnerabilities to be aesthetic 🌈
• --follow-symlinks — follow symlinks and treat them like whatever they are pointing to. If the symlink points to a directory, it will be descended into unless -R is specified. If it's pointing to a file, it will be treated as a file. She commits to the bit, no cap.

---

🫶 AUTHOR 🫶

This manual page was orginally written by Adam Lazur <adam@lazur.org>, for the Debian GNU/Linux system (but may be used by others). Yes, "orginally". We're keeping it exactly as it is, character for character, because that's the law 💀

Modified by Secure Software, Inc.

---

aaaand that's the whole page, bestie 🎀 she's giving September 17, 2001, straight out of the General Commands Manual, RATS(1) and thriving. Go scan something, stay safe, and remember: rough analysis only, manual inspection still required, periodt 💅✨🦋