vulnerability-analysis

---

name: vulnerability-analysis description: Expert-level source code security auditing — taint analysis, memory safety, injection classes, auth flaws, crypto weaknesses, concurrency bugs, supply chain risks metadata: type: offensive phase: analysis

Vulnerability Analysis

Every vulnerability you miss is one an attacker can find. Systematic analysis traces untrusted data from source to sink, evaluates filters for bypass, and questions every trust boundary assumption.

When to Activate

• Reviewing any code for security vulnerabilities
• Auditing authentication, authorization, or session logic
• Evaluating input handling and output encoding
• Assessing cryptographic implementations
• Reviewing file operations, command execution, or deserialization
• Checking for race conditions in concurrent code
• Analyzing dependency security and supply chain risks

Core Methodology

Taint Analysis: Mark untrusted data at origin (source), track propagation to dangerous operations (sink). Vulnerability exists when tainted data reaches sink without adequate sanitization.

Source-Forward: Start from data entry points, trace every path to sinks. Comprehensive but time-consuming.

Sink-Backward: Start from dangerous operations (eval, exec, SQL, innerHTML), trace backward to sources. Faster and targeted.

Hybrid Approach: Sink-backward for rapid high-risk identification, then source-forward for complete coverage.

Rule Categories by Priority

Priority	Category	Impact
1	Taint Analysis	CRITICAL
2	Memory Safety	CRITICAL
3	Injection Attacks	CRITICAL
4	Authentication & Authorization	HIGH
5	Cryptographic Vulnerabilities	HIGH
6	Concurrency & Race Conditions	HIGH
7	Web & API Security	MEDIUM-HIGH
8	Supply Chain & Dependencies	MEDIUM

Audit Protocol

1. Reconnaissance: Identify language, frameworks, trust boundaries, sensitive data, high-value targets. Establish threat model.
2. Attack Surface Enumeration: Map all entry points — HTTP endpoints, CLI args, file inputs, IPC, deserialization points.
3. Systematic Analysis: Apply hybrid taint analysis across all source-sink paths.
4. False Positive Reduction:
   • Trace validation chains upstream — is the value bounded before reaching sink?
   • Confirm reachability — can attacker actually trigger this path?
   • Evaluate against threat model — does exploitation require capabilities attacker doesn't have?
   • Check for established patterns — recognized safe idioms in the domain?
5. Exploitability Gate: Before reporting ANY finding:
   • Are you certain this isn't expected functionality?
   • Is this a valid vulnerability worth reporting?
   • Is it actually exploitable in production?
6. Findings: Document CWE, severity, root cause, exploitation scenario, remediation.
7. Variant Hunting: Generalize each finding into a pattern and search for variants.