Data Flow Tracing

Data Flow Tracing

Purpose

Guide the process of tracing user-controlled input from entry points (sources) through the application to security-sensitive functions (sinks). This is essential for confirming vulnerability exploitability.

When to Use

Activate this skill when:

• Confirming if identified sinks receive user input
• Mapping the path from source to sink
• Understanding data transformations and filters
• Determining if sanitization can be bypassed

Core Concepts

Sources (Input Entry Points)

HTTP Sources:

Language	Common Sources
PHP	$_GET, $_POST, $_REQUEST, $_COOKIE, $_FILES, $_SERVER
Java	request.getParameter(), request.getHeader(), @RequestParam
Python	request.args, request.form, request.data, request.json
Node.js	req.query, req.body, req.params, req.headers
.NET	Request.QueryString, Request.Form, Request["param"]

Other Sources:

• Database queries (stored user data)
• File contents (user-uploaded or modified)
• Environment variables
• External API responses

Sinks (Dangerous Functions)

Refer to the dangerous-functions skill for comprehensive sink lists.

Data Transformations

Track how data changes between source and sink:

• Encoding/Decoding (base64, URL, HTML)
• Concatenation with other strings
• Array/object property access
• Type conversions
• String manipulations

Tracing Methodology

Step 1: Identify the Sink

Start from the dangerous function identified during code review.

Step 2: Find Direct Parameters

Identify what variables/parameters are passed to the sink.

Example: system($cmd);
Direct parameter: $cmd

Step 3: Trace Backwards

Follow each parameter to its origin:

1. Check function parameters
2. Check variable assignments
3. Check conditional branches
4. Check loop iterations
5. Check included/required files

Step 4: Identify Sources

Determine where user input enters:

$cmd = $_GET['command'];  // Direct source
$cmd = $row['command'];   // Database (check how it was stored)
$cmd = $config['cmd'];    // Config file (check if user-modifiable)