analyzing-taint-flow

waiwai24's avatarfrom waiwai24

Tracks untrusted input propagation from sources to sinks in binary code to identify injection vulnerabilities. Use when analyzing data flow, tracing user input to dangerous functions, or detecting command/SQL injection.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 26, 2025
[Security Operations]

When & Why to Use This Skill

This Claude skill automates the detection of security vulnerabilities in binary code by performing advanced taint analysis. It systematically tracks the flow of untrusted data from input sources to dangerous execution sinks, helping security researchers and developers identify critical injection flaws such as command injection, SQL injection, and buffer overflows in compiled software.

Use Cases

  • Vulnerability Research: Automatically tracing user-controlled inputs to sensitive functions in compiled binaries to discover potential zero-day exploits.
  • Security Auditing: Assessing the risk of command or SQL injection in legacy systems or third-party software where source code is unavailable.
  • Malware Analysis: Understanding how external data influences the behavior of suspicious binaries by mapping data flow paths and identifying malicious triggers.
  • Compliance and Risk Assessment: Verifying the effectiveness of input sanitization and validation routines across critical data paths to ensure software integrity.
nameanalyzing-taint-flow
descriptionTracks untrusted input propagation from sources to sinks in binary code to identify injection vulnerabilities. Use when analyzing data flow, tracing user input to dangerous functions, or detecting command/SQL injection.

Taint Analysis

Detection Workflow

  1. Identify sources: Find recv, read, getenv, fgets, scanf, argv (input functions)
  2. Identify sinks: Find system, popen, strcpy, sprintf, execve, malloc (dangerous functions)
  3. Find taint paths: Use xrefs_to to trace from sources to sinks
  4. Analyze sanitization: Check for input validation, length checks, character filtering, encoding/escaping
  5. Assess risk: Determine reachability, check if attacker controls critical parts, evaluate exploitability

Key Patterns

  • Direct command injection: recv() -> buffer -> sprintf(cmd, "echo %s", buffer) -> system(cmd)
  • Path traversal: fgets() -> filename -> fopen(filename, "r")
  • Buffer overflow via tainted size: recv() -> size_buffer -> atoi(size_buffer) -> malloc(size)

Output Format

Report taint paths with: source (function, address, context), sink (function, address, context), path (list of functions), sanitizers_found, is_vulnerable, confidence, vulnerability_type.

Severity Guidelines

  • CRITICAL: Direct injection with no sanitization (command injection, SQL injection)
  • HIGH: Path traversal, buffer overflow via tainted size
  • MEDIUM: Potential injection with partial sanitization
  • LOW: Tainted data with limited impact

See Also

  • patterns.md - Detailed detection patterns and exploitation scenarios
  • examples.md - Example analysis cases and code samples
  • references.md - CWE references and mitigation strategies