Semgrep

v1.79.0Semgrep Inc.

Runs pattern-based rules across source code for security bugs and secure-coding violations. The range's semgrep reads authored source fixtures and prints the findings the rules would produce.

Category: Standards, guidance & secure-development tooling
Package: semgrep
Runs on: Linux · Windows
Commands: semgrep

Rules are parsed and matched against authored source fixtures. No repository is fetched.

Install it

The scripts below install the real Semgrep Inc. package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-semgrep.sh

Windows installer (PowerShell)

Install-semgrep.ps1

Semgrep has no unattended Windows install. Follow the steps on the package page.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Python (pip)

Install the interpreter tooling
```
sudo apt install -y python3-pip
```
Install Semgrep
```
python3 -m pip install semgrep
```
Use a virtual environment on a shared host so the system Python stays clean.

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Semgrep
```
sudo apt install -y semgrep
```

Check it worked

Confirm it landed on PATH
```
which semgrep
```
Check the version
```
semgrep --version
```
The range reports 1.79.0.

Remove it

Take it off again
```
python3 -m pip uninstall semgrep
```

On Windows

Python (pip)

Install Python

winget install --id Python.Python.3.12 -e

Install Semgrep
```
py -m pip install semgrep
```

Check it worked

Confirm it resolves
```
where semgrep
```
Check the version
```
semgrep --version
```
The range reports 1.79.0.

Remove it

Take it off again
```
winget uninstall --id semgrep
```

Inside the range

Tick it on the launch screen
Under Semgrep's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y semgrep
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Semgrep

Pentest: Web App Assessment (OWASP Top 10)Assess a storefront with the Burp-lite workbench at /pentest/proxy: repeat a login, fuzz an id parameter, catch an IDOR and a stored XSS, and file each finding under its OWASP Top 10 category.