Learn
LoginRegister
← All tools

OWASP Dependency-Check

Tool manual · Kali & common usage

Containers · Intermediate · Containers lane

IntermediateSCA
Authorized usage only. Capture and inspect traffic only on systems and networks you own or have written permission to analyze.

What is OWASP Dependency-Check?

OWASP Dependency-Check flags known-vulnerable libraries in builds.

SCA for Maven/Gradle/npm-style projects.

Official website: OWASP Dependency-Check · Documentation

When do you use it?

  • You need Identify known vulnerable dependencies.
  • You are following a CYNARKS lab or authorized engagement that calls for OWASP Dependency-Check.
  • You already tried simpler checks and need this tool’s deeper capability.

Who uses it?

  • Cloud security engineers
  • DevSecOps
  • Platform / SRE security

How do you use it? (typical flow)

  1. Install OWASP Dependency-Check using the steps below (prefer Kali package or official installer).
  2. Confirm you have authorization for the target (lab VM, own system, or written scope).
  3. Run --help / man (or the Help section) to see current flags for your version.
  4. Start with a safe example from Basic commands against localhost or an authorized lab target.
  5. Record what you ran, what you observed, and any follow-up (filter, report, remediation).

Help & manual (like man / --help)

Every serious tool has a built-in way to look up flags. Learn these first so you are not stuck memorizing every option.

  1. 1. Docs

    https://jeremylong.github.io/DependencyCheck/

Kali Linux

CLI/docker; CI oriented.

1. Installation

OSInstallation
Kali LinuxCLI/docker; CI oriented.
Allhttps://owasp.org/www-project-dependency-check/

2. Basic commands

  1. 1. Scan a Maven/Node project

    dependency-check --project lab --scan ./

    Scan a Maven/Node project

  2. 2. Show help

    dependency-check --help

    List flags for your installed version (same habit as man/--help).

  3. 3. Short help

    dependency-check -h

    Alternate help flag when supported.

5. Useful features

  • CVE matching
  • Reports

6. Practical examples

  1. Example 1: Scan a Maven/Node project

    dependency-check --project lab --scan ./

    Scan a Maven/Node project

  2. Example 2: Show help

    dependency-check --help

    List flags for your installed version (same habit as man/--help).

  3. Example 3: Short help

    dependency-check -h

    Alternate help flag when supported.

7. Important notes

  • SCA for legacy stacks.
  • Authorized targets only — labs, systems you own, or written permission.
  • Prefer reading --help / man / official docs for your installed version; flags change over time.

Related course: cloud security · devsecops · Commands: /commands#docker