vulnerability-analysis

name	vulnerability-analysis
description	Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks
metadata	{"type":"offensive","phase":"analysis","tools":"codeql, semgrep, joern, opengrep, trufflehog, gitleaks, kingfisher, osv-scanner, syft, grype, trivy, npm-audit, pip-audit, ysoserial, phpggc","mitre":["T1190","T1059","T1552.001","T1195.001","T1213"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0002","TA0001"],"attck_techniques":["T1190","T1059","T1552.001","T1195.001","T1195.002"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest"]
inputs	["attack_surface_map","source_code"]
outputs	["vulnerability_list","taint_analysis_report","finding_record","sbom"]
references	["references/taint-engines-static-analysis.md","references/injection-source-patterns.md","references/memory-safety-c-cpp.md","references/deserialization-prototype-pollution.md","references/secrets-crypto-authz-concurrency.md","references/supply-chain-dependency-audit.md","references/variant-hunting.md"]
scripts	["scripts/taint_trace.py","scripts/sast_runner.py","scripts/joern_taint.sc","scripts/deser_gadget_scan.py","scripts/secret_crypto_audit.py","scripts/dep_audit.py","scripts/validate_findings.py","scripts/evidence_kit.py","scripts/variant_hunt.py","scripts/path_conditions.py","scripts/merge_runtime_evidence.py"]

Vulnerability Analysis

Every vulnerability you miss is one an attacker finds first. Systematic source auditing traces untrusted data from source to sink, evaluates every sanitizer for bypass, and questions each trust-boundary assumption. This skill is the router; depth lives in references/, and every technique cluster is backed by a runnable tool in scripts/.

When to Activate

• Auditing any codebase (white/grey box) for security vulnerabilities
• Writing/driving CodeQL queries, Semgrep taint rules, or Joern CPGQL flows
• Tracing injection, deserialization, prototype-pollution, or memory-safety paths
• Reviewing auth/authorization (IDOR/BOLA), cryptography, or concurrency (TOCTOU)
• Triaging dependency CVEs and hunting malicious/compromised packages (SCA)
• Variant hunting — generalizing one finding into a codebase-wide pattern

Technique Map

Technique	ATT&CK	CWE	Reference	Script
Taint analysis (source/sink/sanitizer modeling)	T1190	CWE-20	references/taint-engines-static-analysis.md	scripts/taint_trace.py
CodeQL/Semgrep/Joern engine orchestration + merge	T1190	CWE-20	references/taint-engines-static-analysis.md	scripts/sast_runner.py, scripts/joern_taint.sc
SQL injection (raw/ORM/identifier/2nd-order/NoSQL)	T1190	CWE-89	references/injection-source-patterns.md	scripts/taint_trace.py
OS command / argument injection	T1059	CWE-78 / CWE-88	references/injection-source-patterns.md	scripts/taint_trace.py
Server-side template injection	T1190	CWE-1336	references/injection-source-patterns.md	scripts/taint_trace.py
Path traversal	T1083	CWE-22	references/injection-source-patterns.md	scripts/taint_trace.py
SSRF (tainted server-side URL)	T1190	CWE-918	references/injection-source-patterns.md	scripts/taint_trace.py
Integer overflow -> heap/stack overflow	T1203	CWE-190 / CWE-787	references/memory-safety-c-cpp.md	scripts/joern_taint.sc
Use-after-free / double-free	T1203	CWE-416 / CWE-415	references/memory-safety-c-cpp.md	scripts/joern_taint.sc
Unbounded copy / NULL deref	T1203	CWE-120 / CWE-476	references/memory-safety-c-cpp.md	scripts/joern_taint.sc
Insecure deserialization + gadget preconditions	T1059	CWE-502	references/deserialization-prototype-pollution.md	scripts/deser_gadget_scan.py
Prototype pollution -> gadget -> RCE	T1059.007	CWE-1321	references/deserialization-prototype-pollution.md	scripts/deser_gadget_scan.py
Hardcoded secrets / high-entropy literals	T1552.001	CWE-798 / CWE-321	references/secrets-crypto-authz-concurrency.md	scripts/secret_crypto_audit.py
Weak / misused cryptography	T1600	CWE-327 / CWE-328 / CWE-330 / CWE-347	references/secrets-crypto-authz-concurrency.md	scripts/secret_crypto_audit.py
Broken authorization / IDOR / BOLA	T1190	CWE-639 / CWE-862	references/secrets-crypto-authz-concurrency.md	scripts/secret_crypto_audit.py
TOCTOU / race condition	T1190	CWE-367 / CWE-362	references/secrets-crypto-authz-concurrency.md	scripts/secret_crypto_audit.py
Known-CVE dependency (SCA)	T1195.001	CWE-1395 / CWE-1104	references/supply-chain-dependency-audit.md	scripts/dep_audit.py
Malicious package / install worm / typosquat	T1195.002	CWE-506 / CWE-829 / CWE-1357	references/supply-chain-dependency-audit.md	scripts/dep_audit.py
Variant hunting — one finding -> all siblings, root-cause clustered	T1190	CWE-20	references/variant-hunting.md	scripts/variant_hunt.py
Path feasibility — branch guards -> tri-state SAT/UNSAT (Z3 optional)	T1190	CWE-20	references/taint-engines-static-analysis.md	scripts/path_conditions.py
Evidence grounding + FP gate (structured proof, EVD citations)	T1190	CWE-20	references/finding-validation-runtime.md	scripts/validate_findings.py, scripts/evidence_kit.py
Runtime reachability confirmation (Frida sink-executed)	T1190	CWE-20	references/dynamic-instrumentation.md	scripts/merge_runtime_evidence.py

Quick Start

# 0. Intake from recon-osint: languages, frameworks, trust boundaries, entry points.

# 1. Fast triage — rank files by unsanitized source->sink flows (heuristic, multi-lang)
python3 scripts/taint_trace.py trace ./src --lang py,js,php,java --json triage.json
python3 scripts/taint_trace.py config --lang py > seed.semgrep.yml   # seed a real rule

# 2. Deep interprocedural — drive the real engines, then merge into one ranked list
python3 scripts/sast_runner.py semgrep --src ./src --config p/owasp-top-ten --pro --out sg.sarif
python3 scripts/sast_runner.py codeql  --src ./src --lang python \
    --suite codeql/python-queries:codeql-suites/python-security-extended.qls --out cq.sarif
python3 scripts/sast_runner.py joern   --src ./src --script scripts/joern_taint.sc --out joern.json
python3 scripts/sast_runner.py merge   sg.sarif cq.sarif joern.json --out merged.json --top 50

# 3. Class-specific deep passes
python3 scripts/deser_gadget_scan.py  all ./src --json deser.json     # deser sinks + gadget libs
python3 scripts/secret_crypto_audit.py all ./src --json sca.json      # secrets+crypto+authz+TOCTOU
python3 scripts/dep_audit.py          all ./repo --json dep.json      # CVE SCA + worm/typosquat
trufflehog filesystem ./src --only-verified                          # confirm LIVE secrets

# 4. Exploitability gate (per finding): reachable? controllable? real impact? sanitizer real?
#    -> write confirmed issues to templates/exploit/findings/ with
#       severity, CWE, CVSS, taint path, PoC, evidence, ATT&CK ID, remediation.
python3 scripts/evidence_kit.py verify --store evidence.json            # re-hash every artifact
python3 scripts/validate_findings.py --findings findings.json \
    --evidence ./evidence --evidence-store evidence.json --strict       # tier + EVD-citation gate

# 5. After a CONFIRMED finding: hunt every sibling, then prune false-positive paths
python3 scripts/variant_hunt.py ./src --seed-finding findings.json --lang py,js --json variants.json
python3 scripts/taint_trace.py trace ./src --lang py --json trace.json   # trace carries branch guards
python3 scripts/path_conditions.py --trace trace.json --json feasibility.json  # Z3 prune (tri-state)
python3 scripts/merge_runtime_evidence.py --events events.jsonl --findings findings.json --out merged.json

OPSEC & Detection (summary)

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
SAST engine runs	codeql database create, semgrep --sarif, joern-parse process trees; large codeql-db//cpg.bin	CI process-creation Sigma (informational)	offline & silent; CodeQL --command runs target build -> sandbox hostile repos; purge DBs/SARIF on teardown
Injection (SQLi/cmdi/SSTI/SSRF)	SQL keywords/SLEEP, web svc spawning sh/curl, template engine errors, OOB DNS	webserver regex + EDR child-shell Sigma	source review is noiseless; validate with time-based/DNS-OOB, never --dump
Memory safety (C/C++)	SIGSEGV/SIGABRT, glibc corrupted/double free, ASan reports	auditd ANOM_ABEND Sigma; EDR RWX/W^X alerts	CPG review silent; fuzz a local copy in a container, purge cores (may hold secrets)
Deserialization / proto-pollution	Java rO0AB/.NET AAEAAAD///// in bodies; JVM->LDAP/RMI; POST / w/ Next-Action (CVE-2025-55182)	egress Sigma to 389/636/1099/1389; body-marker rules	prove gadget chain exists; id/DNS callback not reverse shell; proto-pollution is global -> revert
Secrets / crypto / authz / TOCTOU	AKIA*/ghp_* patterns; alg:none; sequential-id 200s; symlink-race auditd	secret-scanning push protection; symlink/PATH auditd	secret verification makes a logged provider API call -> only in scope; read one record for IDOR/TOCTOU evidence
Supply chain (SCA / worm)	install hook spawning shell/net; bundle.js/setup_bun.js; new public Shai-Hulud repo	install-script process-creation Sigma; agentless SBOM lookup	never npm install a suspect tree; --ignore-scripts in a disposable container; treat a compromised dep as full host compromise

Deep Dives

• references/taint-engines-static-analysis.md — taint theory + propagation rules; Semgrep (taint mode, Pro interfile, Opengrep), CodeQL modular dataflow API, Joern CPG/reachableBy; engine orchestration + multi-tool merge; CPG+LLM (2025).
• references/injection-source-patterns.md — source-code shapes of SQLi (incl. identifier/ORDER BY/2nd-order/NoSQL), OS command & argument injection, SSTI, path traversal, SSRF; per-language safe/vuln pairs; Joern/Semgrep confirmation.
• references/memory-safety-c-cpp.md — integer overflow->overflow, UAF/double-free, unbounded copy, NULL deref; the 2025 libxml2 CVE cluster; ASan/UBSan + fuzzing confirmation; unsafe Rust surface.
• references/deserialization-prototype-pollution.md — CWE-502 sinks + gadget preconditions (ysoserial/phpggc/ysoserial.net), JS prototype pollution->RCE; React2Shell CVE-2025-55182, Tomcat CVE-2025-24813, lodash CVE-2025-13465, Silent Spring.
• references/secrets-crypto-authz-concurrency.md — hardcoded secrets (gitleaks/ trufflehog/Kingfisher), weak crypto, IDOR/BOLA, TOCTOU/race; LLM-augmented secret detection (2025).
• references/supply-chain-dependency-audit.md — OSV/SCA, malicious-package & install worm heuristics, typosquats; Shai-Hulud 1.0/2.0/Mini (CVE-2026-45321), the SLSA provenance-bypass lesson.
• references/variant-hunting.md — HUNT protocol: one confirmed finding -> tree-wide sibling sweep, same-function taint qualification, root-cause clustering (copy-paste/shared-util/ framework-misuse) to decide one-fix-or-many; backed by variant_hunt.py. Pairs with evidence_kit.py (re-verifiable EVD evidence), path_conditions.py (Z3 path-prune, tri-state), and merge_runtime_evidence.py (Frida runtime sink confirmation).