Vulnerability Analysis

Every vulnerability you miss is one an attacker finds first. Systematic source auditing traces untrusted data from source to sink, evaluates every sanitizer for bypass, and questions each trust-boundary assumption. This skill is the router; depth lives in references/, and every technique cluster is backed by a runnable tool in scripts/.

When to Activate

• Auditing any codebase (white/grey box) for security vulnerabilities
• Writing/driving CodeQL queries, Semgrep taint rules, or Joern CPGQL flows
• Tracing injection, deserialization, prototype-pollution, or memory-safety paths
• Reviewing auth/authorization (IDOR/BOLA), cryptography, or concurrency (TOCTOU)
• Triaging dependency CVEs and hunting malicious/compromised packages (SCA)
• Variant hunting — generalizing one finding into a codebase-wide pattern

Technique Map

Quick Start

# 0. Intake from recon-osint: languages, frameworks, trust boundaries, entry points.

# 1. Fast triage — rank files by unsanitized source->sink flows (heuristic, multi-lang)
python3 scripts/taint_trace.py trace ./src --lang py,js,php,java --json triage.json
python3 scripts/taint_trace.py config --lang py > seed.semgrep.yml   # seed a real rule

# 2. Deep interprocedural — drive the real engines, then merge into one ranked list
python3 scripts/sast_runner.py semgrep --src ./src --config p/owasp-top-ten --pro --out sg.sarif
python3 scripts/sast_runner.py codeql  --src ./src --lang python \
    --suite codeql/python-queries:codeql-suites/python-security-extended.qls --out cq.sarif
python3 scripts/sast_runner.py joern   --src ./src --script scripts/joern_taint.sc --out joern.json
python3 scripts/sast_runner.py merge   sg.sarif cq.sarif joern.json --out merged.json --top 50

# 3. Class-specific deep passes
python3 scripts/deser_gadget_scan.py  all ./src --json deser.json     # deser sinks + gadget libs
python3 scripts/secret_crypto_audit.py all ./src --json sca.json      # secrets+crypto+authz+TOCTOU
python3 scripts/dep_audit.py          all ./repo --json dep.json      # CVE SCA + worm/typosquat
trufflehog filesystem ./src --only-verified                          # confirm LIVE secrets

# 4. Exploitability gate (per finding): reachable? controllable? real impact? sanitizer real?
#    -> write confirmed issues to templates/exploit/findings/ with
#       severity, CWE, CVSS, taint path, PoC, evidence, ATT&CK ID, remediation.
python3 scripts/evidence_kit.py verify --store evidence.json            # re-hash every artifact
python3 scripts/validate_findings.py --findings findings.json \
    --evidence ./evidence --evidence-store evidence.json --strict       # tier + EVD-citation gate

# 5. After a CONFIRMED finding: hunt every sibling, then prune false-positive paths
python3 scripts/variant_hunt.py ./src --seed-finding findings.json --lang py,js --json variants.json
python3 scripts/taint_trace.py trace ./src --lang py --json trace.json   # trace carries branch guards
python3 scripts/path_conditions.py --trace trace.json --json feasibility.json  # Z3 prune (tri-state)
python3 scripts/merge_runtime_evidence.py --events events.jsonl --findings findings.json --out merged.json

OPSEC & Detection (summary)

Deep Dives

• references/taint-engines-static-analysis.md — taint theory + propagation rules; Semgrep (taint mode, Pro interfile, Opengrep), CodeQL modular dataflow API, Joern CPG/reachableBy; engine orchestration + multi-tool merge; CPG+LLM (2025).
• references/injection-source-patterns.md — source-code shapes of SQLi (incl. identifier/ORDER BY/2nd-order/NoSQL), OS command & argument injection, SSTI, path traversal, SSRF; per-language safe/vuln pairs; Joern/Semgrep confirmation.
• references/memory-safety-c-cpp.md — integer overflow->overflow, UAF/double-free, unbounded copy, NULL deref; the 2025 libxml2 CVE cluster; ASan/UBSan + fuzzing confirmation; unsafe Rust surface.
• references/deserialization-prototype-pollution.md — CWE-502 sinks + gadget preconditions (ysoserial/phpggc/ysoserial.net), JS prototype pollution->RCE; React2Shell CVE-2025-55182, Tomcat CVE-2025-24813, lodash CVE-2025-13465, Silent Spring.
• references/secrets-crypto-authz-concurrency.md — hardcoded secrets (gitleaks/ trufflehog/Kingfisher), weak crypto, IDOR/BOLA, TOCTOU/race; LLM-augmented secret detection (2025).
• references/supply-chain-dependency-audit.md — OSV/SCA, malicious-package & install worm heuristics, typosquats; Shai-Hulud 1.0/2.0/Mini (CVE-2026-45321), the SLSA provenance-bypass lesson.
• references/variant-hunting.md — HUNT protocol: one confirmed finding -> tree-wide sibling sweep, same-function taint qualification, root-cause clustering (copy-paste/shared-util/ framework-misuse) to decide one-fix-or-many; backed by variant_hunt.py. Pairs with evidence_kit.py (re-verifiable EVD evidence), path_conditions.py (Z3 path-prune, tri-state), and merge_runtime_evidence.py (Frida runtime sink confirmation).