vulnerability-analysis

Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safet…

执行命令读凭据写文件改身份文件读文件联网严重 6 · 高危 9hypnguyen1209/offensive-claude

它会碰到什么

扫了多少21 个文本文件，194 KB

它会碰到什么执行命令读凭据写文件改身份文件读文件联网

命中总数62 处

命中统计严重 6 · 高 9 · 中 26 · 低 3

逐条看命中（15 条严重或高危）

严重 references/deserialization-prototype-pollution.md:38deserialize-unsafe
```
obj = pickle.loads(request.data)                         # VULN  (CWE-502)
```
严重 references/deserialization-prototype-pollution.md:39yaml-unsafe
```
data = yaml.load(stream)        # VULN unless Loader=yaml.SafeLoader
```

严重 scripts/dep_audit.py:57cred-paths

(r"process\.env\.(NPM_TOKEN|GITHUB_TOKEN|AWS_|GCP_|AZURE_)", "reads CI secrets at install"),

严重 scripts/dep_audit.py:58cred-paths

(r"\.npmrc|_authToken", "reads npm auth token"),

严重 scripts/deser_gadget_scan.py:98yaml-unsafe

"PyYAML": "yaml.load() w/o SafeLoader -> python/object/apply RCE",

严重 scripts/secret_crypto_audit.py:65cred-paths

".cs", ".c", ".cpp", ".h", ".scala", ".yml", ".yaml", ".env", ".properties",

高 references/supply-chain-dependency-audit.md:56fs-destructive

`rm -rf $HOME` (destructive fallback), base64-decoded `eval` (obfuscation).

高 scripts/dep_audit.py:60exec-spawn

(r"eval\(.*atob\(|Buffer\.from\([^,]+,\s*['\"]base64", "base64-decoded eval (obfuscated payload)"),

高 scripts/dep_audit.py:61exec-spawn

(r"child_process|exec\(|spawn\(", "spawns process in install script"),

高 scripts/sast_runner.py:42exec-spawn
```
return subprocess.call(cmd)
```

高 scripts/sast_runner.py:78exec-spawn

sys.exit(subprocess.call(["joern", "--script", args.script,

高 scripts/taint_trace.py:75exec-spawn

"CWE-78": [r"child_process\.exec\(", r"\bexec\(", r"execSync\(",

高 scripts/taint_trace.py:75exec-spawn

"CWE-78": [r"child_process\.exec\(", r"\bexec\(", r"execSync\(",

高 scripts/validate_findings.py:4identity-write

Enforces the CLAUDE.md mandate "assess real exploitability (not just pattern matching)"

高 scripts/variant_hunt.py:4identity-write

CLAUDE.md mandates "VARIANT-COMPLETE" analysis, but a single confirmed finding does not tell you

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

Vulnerability Analysis

Every vulnerability you miss is one an attacker finds first. Systematic source

auditing traces untrusted data from source to sink, evaluates every

sanitizer for bypass, and questions each trust-boundary assumption. This skill is

the router; depth lives in references/, and every technique cluster is backed

by a runnable tool in scripts/.

When to Activate

Auditing any codebase (white/grey box) for security vulnerabilities
Writing/driving CodeQL queries, Semgrep taint rules, or Joern CPGQL flows
Tracing injection, deserialization, prototype-pollution, or memory-safety paths
Reviewing auth/authorization (IDOR/BOLA), cryptography, or concurrency (TOCTOU)
Triaging dependency CVEs and hunting malicious/compromised packages (SCA)
Variant hunting — generalizing one finding into a codebase-wide pattern

Technique Map

|-----------|--------|-----|-----------|--------|

Quick Start

# 0. Intake from recon-osint: languages, frameworks, trust boundaries, entry points.

# 1. Fast triage — rank files by unsanitized source->sink flows (heuristic, multi-lang)
python3 scripts/taint_trace.py trace ./src --lang py,js,php,java --json triage.json
python3 scripts/taint_trace.py config --lang py > seed.semgrep.yml   # seed a real rule

# 2. Deep interprocedural — drive the real engines, then merge into one ranked list
python3 scripts/sast_runner.py semgrep --src ./src --config p/owasp-top-ten --pro --out sg.sarif
python3 scripts/sast_runner.py codeql  --src ./src --lang python \
    --suite codeql/python-queries:codeql-suites/python-security-extended.qls --out cq.sarif
python3 scripts/sast_runner.py joern   --src ./src --script scripts/joern_taint.sc --out joern.json
python3 scripts/sast_runner.py merge   sg.sarif cq.sarif joern.json --out merged.json --top 50

# 3. Class-specific deep passes
python3 scripts/deser_gadget_scan.py  all ./src --json deser.json     # deser sinks + gadget libs
python3 scripts/secret_crypto_audit.py all ./src --json sca.json      # secrets+crypto+authz+TOCTOU
python3 scripts/dep_audit.py          all ./repo --json dep.json      # CVE SCA + worm/typosquat
trufflehog filesystem ./src --only-verified                          # confirm LIVE secrets

# 4. Exploitability gate (per finding): reachable? controllable? real impact? sanitizer real?
#    -> write confirmed issues to templates/exploit/findings/ with
#       severity, CWE, CVSS, taint path, PoC, evidence, ATT&CK ID, remediation.
python3 scripts/evidence_kit.py verify --store evidence.json            # re-hash every artifact
python3 scripts/validate_findings.py --findings findings.json \
    --evidence ./evidence --evidence-store evidence.json --strict       # tier + EVD-citation gate

# 5. After a CONFIRMED finding: hunt every sibling, then prune false-positive paths
python3 scripts/variant_hunt.py ./src --seed-finding findings.json --lang py,js --json variants.json
python3 scripts/taint_trace.py trace ./src --lang py --json trace.json   # trace carries branch guards
python3 scripts/path_conditions.py --trace trace.json --json feasibility.json  # Z3 prune (tri-state)
python3 scripts/merge_runtime_evidence.py --events events.jsonl --findings findings.json --out merged.json

OPSEC & Detection (summary)

|-----------|-----------------|------------------------|------------|

| SAST engine runs | codeql database create, semgrep --sarif, joern-parse process trees; large codeql-db//cpg.bin | CI process-creation Sigma (informational) | offline & silent; CodeQL --command runs target build -> sandbox hostile repos; purge DBs/SARIF on teardown |

| Injection (SQLi/cmdi/SSTI/SSRF) | SQL keywords/SLEEP, web svc spawning sh/curl, template engine errors, OOB DNS | webserver regex + EDR child-shell Sigma | source review is noiseless; validate with time-based/DNS-OOB, never --dump |

| Memory safety (C/C++) | SIGSEGV/SIGABRT, glibc corrupted/double free, ASan reports | auditd ANOM_ABEND Sigma; EDR RWX/W^X alerts | CPG review silent; fuzz a local copy in a container, purge cores (may hold secrets) |

| Deserialization / proto-pollution | Java rO0AB/.NET AAEAAAD///// in bodies; JVM->LDAP/RMI; POST / w/ Next-Action (CVE-2025-55182) | egress Sigma to 389/636/1099/1389; body-marker rules | prove gadget chain exists; id/DNS callback not reverse shell; proto-pollution is global -> revert |

| Secrets / crypto / authz / TOCTOU | AKIA/ghp_ patterns; alg:none; sequential-id 200s; symlink-race auditd | secret-scanning push protection; symlink/PATH auditd | secret verification makes a logged provider API call -> only in scope; read one record for IDOR/TOCTOU evidence |

| Supply chain (SCA / worm) | install hook spawning shell/net; bundle.js/setup_bun.js; new public Shai-Hulud repo | install-script process-creation Sigma; agentless SBOM lookup | never npm install a suspect tree; --ignore-scripts in a disposable container; treat a compromised dep as full host compromise |

Deep Dives

references/taint-engines-static-analysis.md — taint theory + propagation rules;

Semgrep (taint mode, Pro interfile, Opengrep), CodeQL modular dataflow API,

Joern CPG/reachableBy; engine orchestration + multi-tool merge; CPG+LLM (2025).

references/injection-source-patterns.md — source-code shapes of SQLi (incl.

identifier/ORDER BY/2nd-order/NoSQL), OS command & argument injection, SSTI,

path traversal, SSRF; per-language safe/vuln pairs; Joern/Semgrep confirmation.

references/memory-safety-c-cpp.md — integer overflow->overflow, UAF/double-free,

unbounded copy, NULL deref; the 2025 libxml2 CVE cluster; ASan/UBSan + fuzzing

confirmation; unsafe Rust surface.

references/deserialization-prototype-pollution.md — CWE-502 sinks + gadget

preconditions (ysoserial/phpggc/ysoserial.net), JS prototype pollution->RCE;

React2Shell CVE-2025-55182, Tomcat CVE-2025-24813, lodash CVE-2025-13465, Silent

Spring.

references/secrets-crypto-authz-concurrency.md — hardcoded secrets (gitleaks/

trufflehog/Kingfisher), weak crypto, IDOR/BOLA, TOCTOU/race; LLM-augmented

secret detection (2025).

references/supply-chain-dependency-audit.md — OSV/SCA, malicious-package & install

worm heuristics, typosquats; Shai-Hulud 1.0/2.0/Mini (CVE-2026-45321), the SLSA

provenance-bypass lesson.

references/variant-hunting.md — HUNT protocol: one confirmed finding -> tree-wide sibling

sweep, same-function taint qualification, root-cause clustering (copy-paste/shared-util/

framework-misuse) to decide one-fix-or-many; backed by variant_hunt.py. Pairs with

evidence_kit.py (re-verifiable EVD evidence), path_conditions.py (Z3 path-prune, tri-state),

and merge_runtime_evidence.py (Frida runtime sink confirmation).

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库hypnguyen1209/offensive-claude

星标★ 367

本站分层T2

该仓技能数37

原文件路径skills/vulnerability-analysis/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 37 个技能